Loading…
Okta
Identity and access management company providing authentication, authorization, single sign-on, and identity security solutions.
- 69 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
Build a Secure TypeScript MCP Client with Cross App Access (XAA)
The post presents a tutorial for building a TypeScript Model Context Protocol (MCP) client that uses Cross App Access (XAA) to securely bridge enterprise apps across trust domains. The sample app is an employee onboarding dashboard that signs in through an identity provider, exchanges identity for an Identity Assertion JWT Authorization Grant (ID-JAG), trades it for an access token, and fetches data from a protected MCP server. The tutorial uses the MCP TypeScript SDK’s CrossAppAccessProvider to automate the four-step XAA flow, including token exchange and retry on 401 responses. Developers test against xaa.dev, a free playground that hosts the IdP, authorization server, and a todo MCP server. The post explains key concepts like ID-JAG claims, separate client credentials per trust domain, and how XAA enables AI agents and enterprise apps to act on behalf of users without OAuth consent screens.
Classic Engine Feature EOL: SSR, Desktop SSO, Device Trust
Okta will end support for Self-Service Registration, Desktop Single Sign-On using Integrated Windows Authentication (IWA), and Device Trust on Classic Engine on March 5, 2027. After that deadline, the capabilities will be turned off unless organizations upgrade to Okta Identity Engine, and Okta will no longer address related bugs, security vulnerabilities, or broken flows. The migration paths are Profile Enrollment Policy for self-service registration, Agentless Desktop Single Sign-On or Okta FastPass for desktop authentication, and management attestation with Okta Verify for mobile device trust. Identity Engine adds passwordless authentication, device assurance, phishing-resistant multifactor authentication, identity verification, zero-trust capabilities, and a newer policy framework, with the upgrade included at no additional licensing cost. Organizations are advised to assess feature usage, test in non-production, and schedule production migration before the hard deadline.
Supercharge Auth with Signals and the New Okta Angular SDK
The updated Okta Angular SDK introduces fully standalone architecture, eliminating NgModules and wrapper functions in favor of standalone providers and functional guards. In an Angular v22 sample project, authentication is configured with the provideOktaAuth function without requiring a custom backend. Route security utilizes functional guards, while user and group data fetch flows are handled using rxResource alongside signal inputs. To support dynamic environments without requiring rebuilds or redeployments, the setup implements runtime configuration loading via provideAppInitializer and OktaAuthConfigService. Security is further bolstered by binding access tokens to browser key pairs using Demonstrating Proof of Possession alongside OAuth 2.1 and OpenID Connect protocols.
Add Cross App Access to Your OIDC Resource Application
Cross App Access allows applications such as AI agents to access resource APIs on behalf of OpenID Connect federated users. The specification relies on an Identity Assertion Authorization Grant, which is a short-lived JSON Web Token issued by the customer Identity Provider. Resource authorization servers validate this token, resolve user identities using combined issuer and subject claims, and issue locally scoped access tokens without altering single sign-on flows. Implementations must bind issuers to registered connections before verifying signatures to prevent forgery attacks. In addition, servers should not issue refresh tokens, as clients instead resubmit the grant upon access token expiration.
Add Cross App Access to Your OIDC Requesting Application
OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.
I Found My Coordinates: Code, Community, and Okta
A career progression through community leadership and software engineering led to a new role at Okta. Starting as a campus ambassador and Google Developer Student Clubs lead in India, the author organized hackathons, workshops, and meetups to foster peer learning. To effectively advocate for developers, an internship as a Developer Advocate at Zuplo prompted hands-on engineering experience as a Software Development Engineer at JPMorgan. After mentoring over 10,000 students and growing a technical community to over 600,000 members, the author joined Okta as a Senior Builder Advocate. In this role, advocacy extends beyond traditional coders to support AI builders, low-code creators, and developers utilizing identity and access management tools.
Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls
Flask web applications require dedicated mechanisms to authenticate users securely and authorize access to downstream services. Developers can address this by integrating Okta as an OpenID Connect identity provider using the Authlib library. Authlib registers Okta as a remote provider and automates the Authorization Code flow using Proof Key for Code Exchange with SHA-256 code challenge verification. After logging in through Okta and completing the callback route, the Flask web application uses the acquired OAuth 2.0 access token to query a protected backend resource server. This architecture ensures that user credentials remain managed by Okta while client requests to backend API endpoints carry valid, scoped authorization tokens.
Enable Your SAML Requesting App for Cross App Access
Cross App Access allows enterprise applications federated with Security Assertion Markup Language to interact with third-party resource APIs without migrating to OpenID Connect. The flow adapts the Identity Assertion Authorization Grant specification to SAML by adding three token exchange steps following the standard single sign-on handshake. First, the application exchanges the validated SAML assertion for an OAuth refresh token using Okta's token endpoint and a private key JSON Web Token. The application then uses the refresh token to request a short-lived Identity Assertion Authorization Grant token from Okta. Finally, the application presents the Identity Assertion Authorization Grant token to the third-party authorization server to obtain an OAuth access token.
Build a Secure C# MCP App with Cross App Access (XAA)
Cross App Access (XAA) addresses the gap between a user’s authenticated identity and a downstream MCP server, API, or agent tool that must trust that identity without another login. The described flow uses OIDC and PKCE for sign-in, then RFC 8693 token exchange to turn the ID token into a JWT Authorization Grant (JAG), followed by RFC 7523 exchange at the MCP authorization server for a scoped bearer token. A C# MCP SDK IdentityAssertionGrantProvider encapsulates both exchanges, while ASP.NET Core OIDC middleware persists the ID token and an HTTP transport presents the resulting token to the MCP server. The sample connects to a Todo resource through the xaa.dev playground, completes MCP initialization, lists resources, and reads todo0://todos; the article states that the end-to-end implementation fits in under 50 lines of C#.
Introducing Okta Journeys: A Better Way for Developers to Learn Identity
Okta has introduced Journeys, a task-oriented documentation format designed to streamline how developers learn and implement identity management. Rather than requiring engineers to manually assemble information across disparate guides, articles, and API references, each Journey provides an end-to-end curriculum for a specific project. Content is organized into three distinct phases: foundational knowledge in Learn, architectural decision-making in Plan, and curated implementation steps in Build. The initial release includes six Journeys aimed at Okta Customer Identity builders who are implementing authentication, registration, branding, and user management. Future additions will address AI agent governance, integrations for the Okta Integration Network, and migrations from the Classic Engine to the Okta Identity Engine.
How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)
Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta.
Enabling Cross App Access for SAML-Based Resource Apps
Cross App Access (XAA) lets applications using existing SAML federation obtain API access without migrating to OpenID Connect (OIDC). An agent presents a short-lived Identity Assertion Authorization Grant (ID-JAG), which the resource authorization server validates, resolves to a user, and exchanges for its own access token; SAML processing remains upstream. For SAML identity resolution, implementations must validate the saml-nameid sub_id and match issuer, NameID, and sp_name_qualifier rather than relying on NameID alone. The guide recommends binding iss to a registered SAML connection before verifying the JWT against that connection’s JWKS, then checking typ, aud, and client_id and applying local scope policy. It also walks through Okta configuration and xaa.dev checks that redeem the ID-JAG, call the API, and export conformance results.
The Builder Revolution: Why We're Shifting to Builder Advocacy
The team formerly known as Developer Advocacy, within Developer Success, has been renamed Builder Advocacy within Builder Experience (BX). The change responds to an expanded definition of who builds with technology: alongside traditional developers, AI builders and no-code or low-code automators are creating production-level experiences and mission-critical infrastructure. The organization says its advocacy will serve developers, prompt engineers, LLM integrators, AI-agent creators, ML practitioners, and automation-focused builders, while continuing support for traditional coders, engineers, and architects. The announcement cites GitHub’s 180 million developers, 36 million new developers in 2025, and Stack Overflow’s finding that 84% use or plan to use AI tools. The rename is effective immediately and begins broader investments in resources, content, and community programs for this wider builder community.
How Verifiable Digital Credentials Are Reshaping Trust Architecture
Verifiable Digital Credentials (VDCs) are presented as a new trust layer for applications that need to verify claims such as age, licenses, employment, or eligibility without collecting documents and excess PII. The model uses an Issuer-Holder-Verifier trust triangle: authorities sign credentials, users hold them in wallets, and applications request specific proofs, with selective disclosure limiting exposed data. The standards stack combines SD-JWT VC or mdoc credential formats, OpenID4VCI for issuance, OpenID4VP for presentation, and the W3C Digital Credentials API for browser-wallet invocation. Production verification also requires issuer trust lists, trust-framework integration, and key rotation, not merely signature checks. Because browser API rollout is still progressing, the recommended baseline is redirect-based OpenID4VP with the Digital Credentials API added as a progressive enhancement, starting with one bounded verification use case.
Long Story Short: I Found My Place Between Code and Community
Aasawari Sahasrabuddhe describes moving from backend software development into developer relations after finding that coding alone felt incomplete. Her DevRel work combines community engineering, content creation, strategy, workshop building, technical writing, hands-on workshops, and public speaking, while retaining a technical base in Java, Quarkus, and Spring Boot. She also discusses deeper interests in containers, Kubernetes, Docker, CI/CD, and GitOps, along with recognition as a MongoDB Champion for community contributions. The announcement introduces her move to Okta, where she wants to examine the intersection of identity, security, and AI, including how identity supports trust, access, and governance for AI systems. She frames this role as a way to stay close to community while continuing to work with code and content.
Okta Developer Connect San Francisco 2026 Recap
Okta Developer Connect San Francisco brought more than 100 developers, architects, founders, platform engineers, and security leaders to Okta HQ for technical sessions, hands-on labs, and community conversations about securing identity in the age of AI. The keynote announced general availability of Okta for AI Agents, which provides discovery, shadow AI detection, short-lived credentials, scoped tokens, vaulted secrets, MCP server controls, lifecycle governance, SIEM audit logs, and a kill switch. Sessions examined Cross App Access, using identity assertion and token exchange across a requesting app, identity provider, and resource app, plus Auth0-based patterns including Token Vault, asynchronous authorization, and fine-grained access control. Discussions described agents outpacing governance, static credentials creating risk, and RAG pipelines requiring data-layer permissions that match user access. The event concluded that builders should treat agents as identities with ownership, scope, review, consent, and revocation designed before integrations go live.
The One Where I Found My Way to DevRel
The author recounts a career path from creative interests and technical writing to developer relations, emphasizing that storytelling remained central while the audience changed. She began by producing API documentation, user guides, onboarding content, and other developer resources, then joined JDoodle, where conversations with developers shifted her focus from writing for them to connecting with them. Attending events and conferences, giving product demos, staffing booths, participating in community conversations, organizing hackathons, and running internal events helped her discover that developer advocacy matched her strengths in empathy, clear storytelling, and helping people succeed. She now announces a new role at Okta, where she will work with developers, creators, builders, and community members in identity and security while creating content, attending events, learning, and building connections.
How to Build Low-Code API Integrations for Enterprise Apps Using Okta
Okta’s API Integration Actions let independent software vendors build Provisioning, Entitlements, and Universal Logout integrations in the Okta Integration Network using Workflows, Okta’s low-code builder. The approach maps existing APIs directly to Okta action contracts, allowing developers to avoid building and maintaining a SCIM server while translating API calls into formats Okta can consume. The guide walks through creating an OIN integration, configuring tenant and authentication mappings, adding API Integration Action components, building and validating flows, and submitting them through the OIN Wizard. It also explains how to create and update an org-only test instance before review, noting that submission changes do not automatically update an existing test instance for security reasons.
Make Secure App-to-App Connections Using Cross App Access
Enterprise app-to-app integrations can create governance, security, and consent problems when API keys lack user context and standard OAuth leaves connection approval to individuals. The tutorial adds Cross App Access (XAA), an OAuth extension based on the Identity Assertion Authorization Grant, to a NestJS note-taking app and connects it to a to-do app through xaa.dev. It uses TypeScript, openid-client, and the testing site’s IdP, with two token exchanges: an ID token becomes an ID-JAG token, then a JWT-bearer grant exchanges that assertion at the resource authorization server for an access token. After authentication, the completed flow calls the to-do API and exposes each handshake step and response in console logs.
Take User Provisioning to the Next Level with Entitlements
This workshop extends a React and Express.js Todo application’s SCIM-based user provisioning to include entitlements such as roles, licensing, and permissions for enterprise B2B SaaS use. Starting from completed SCIM workshop code, it adds a /Roles endpoint, database-backed roles, SCIM schemas and resource types, and TypeScript implementations that conform to SCIM responses and user resources. The walkthrough connects the API to an Okta SCIM application, discovers schemas and characteristics, and demonstrates synchronizing existing entitlements and assigning a custom is_tall characteristic to a user. It also discusses multi-tenant designs, where organization-specific roles can be addressed through an API key in the Authorization header, while recommending OAuth for production.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.