---
title: "Add Step"
description: "The tutorial shows how to add OAuth 2.0 Step Up Authentication Challenge support to an Angular frontend and NestJS backend, so sensitive routes and API resources can require stronger authentication than ordinary access. It starts from a Lerna monorepo, configures an OAuth 2.0/OpenID Connect single-page application, and uses Okta libraries plus an Okta JWT Verifier to establish the basic authenticated app. The implementation checks authentication assurance through token ACR claims, returns the standard insufficient_user_authentication error when an API request lacks the required assurance, and uses Angular interceptor and application-code handling to redirect with acr_values before retrying. It also describes authentication recency through max_age and auth_time, while noting that the original Okta CLI instructions no longer work exactly as written after the May 2025 account-plan change."
---

# Add Step

[Okta](https://yomu.fyi/company/okta) · Alisa Duncan · Mar 12, 2024

**Type:** Tutorial

## Summary

The tutorial shows how to add OAuth 2.0 Step Up Authentication Challenge support to an Angular frontend and NestJS backend, so sensitive routes and API resources can require stronger authentication than ordinary access. It starts from a Lerna monorepo, configures an OAuth 2.0/OpenID Connect single-page application, and uses Okta libraries plus an Okta JWT Verifier to establish the basic authenticated app. The implementation checks authentication assurance through token ACR claims, returns the standard insufficient\_user\_authentication error when an API request lacks the required assurance, and uses Angular interceptor and application-code handling to redirect with acr\_values before retrying. It also describes authentication recency through max\_age and auth\_time, while noting that the original Okta CLI instructions no longer work exactly as written after the May 2025 account-plan change.

## Context

Authentication is presented as more than a binary state: different actions can require different authentication strength or recency. The OAuth 2.0 Step Up Authentication Challenge standard provides rules for identifying those requirements and defines the insufficient\_user\_authentication response used when a request lacks the required assurance.

## Approach / What changed

The implementation starts with an Angular and NestJS Lerna monorepo, configures an OAuth 2.0 and OpenID Connect application, and adds Okta authentication libraries. Angular route protection uses authentication requirements, while the NestJS API checks the access token’s ACR claim in middleware. An Angular interceptor recognizes step-up errors, and application code redirects with acr\_values, stores the original URL, and retries the resource request after stronger authentication.

## Takeaways

- The Step Up Authentication Challenge protocol supports conditional authentication requirements, including authentication mechanism strength and authentication recency.
- The NestJS API can check an access token’s ACR claim and respond with insufficient\_user\_authentication when the requested resource needs stronger authentication.
- Angular handles a step-up response by reading acr\_values, preserving the current route, redirecting for authentication, and re-requesting the resource afterward.

## FAQ

### How does the Angular application trigger step-up authentication after an API error?

An interceptor identifies the insufficient\_user\_authentication response, while the code making the API call handles the redirect. It preserves the current URL and calls signInWithRedirect with the returned acr\_values so the resource can be requested again after authentication.

### How is authentication recency enforced?

The redirect request uses max\_age to define the required recency instead of acr\_values. The auth\_time claim is used to evaluate whether the token satisfies that max\_age requirement.

### Can the original Okta CLI setup instructions still be followed exactly?

No. The post notes that in May 2025 the Okta Integrator Free Plan replaced Okta Developer Edition Accounts and the Okta CLI was deprecated. It directs users to configure Okta manually using the Developer Documentation instead.

**Tags:** [Angular](https://yomu.fyi/topic/angular), [NestJS](https://yomu.fyi/topic/nestjs), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [OpenID Connect](https://yomu.fyi/topic/openid-connect)

- Source: [Okta](https://developer.okta.com/blog/2024/03/12/stepup-authentication)
- Source URL: https://developer.okta.com/blog/2024/03/12/stepup-authentication
- Ingested by Yomu: 2026-09-17T14:06:34.121Z

[Read original post](https://developer.okta.com/blog/2024/03/12/stepup-authentication)