Loading post…
OktaAkanksha BhasinAnnouncement
Okta Developer Connect San Francisco 2026 Recap
Summary
Okta Developer Connect San Francisco brought more than 100 developers, architects, founders, platform engineers, and security leaders to Okta HQ for technical sessions, hands-on labs, and community conversations about securing identity in the age of AI. The keynote announced general availability of Okta for AI Agents, which provides discovery, shadow AI detection, short-lived credentials, scoped tokens, vaulted secrets, MCP server controls, lifecycle governance, SIEM audit logs, and a kill switch. Sessions examined Cross App Access, using identity assertion and token exchange across a requesting app, identity provider, and resource app, plus Auth0-based patterns including Token Vault, asynchronous authorization, and fine-grained access control. Discussions described agents outpacing governance, static credentials creating risk, and RAG pipelines requiring data-layer permissions that match user access. The event concluded that builders should treat agents as identities with ownership, scope, review, consent, and revocation designed before integrations go live.
Context
Engineering teams are deploying AI agents faster than they can establish governance, creating concerns around discovery, credentials, permissions, lifecycle management, and non-human identity. The event addressed how established identity principles such as least privilege, scoped access, consent, and auditability apply to agents connecting with enterprise data, APIs, MCP servers, and other applications.
Approach / What changed
The event presented Okta for AI Agents, Cross App Access, and Auth0 identity patterns for AI applications. The described controls include agent discovery, shadow AI detection, short-lived and scoped credentials, vaulted secrets, policy-mediated access, identity assertion and token exchange, asynchronous authorization, fine-grained authorization, lifecycle governance, SIEM audit logs, and agent deactivation.
Takeaways
Okta for AI Agents reached general availability with discovery across frameworks, clouds, and SaaS environments, shadow AI detection, scoped credentials, MCP controls, lifecycle governance, SIEM streaming, and a kill switch.
Cross App Access uses an identity provider to mediate application-to-application access according to policy, with identity assertion and token exchange across requesting and resource applications.
The Auth0 session recommended Token Vault, asynchronous authorization, and fine-grained authorization so agents avoid long-lived credentials and retrieve or trigger only what the user can access.
Source and freshness
- Source
- developer.okta.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.