---
title: "Step"
description: "Step-up authentication lets an application permit access to non-critical resources with basic authentication while requiring additional authentication for sensitive resources. The post describes how Okta Workforce Identity Cloud supports this pattern across modern OIDC applications and legacy integrations. For OIDC, applications use the /authorize endpoint’s acr_values and max_age parameters to request a mapped higher assurance level for a limited period, or prompt=login to force re-authentication each time. For non-OIDC applications, privileged Factor API operations can issue and verify challenges through a protected middleware layer using an Okta API token, while Okta Access Gateway can enforce step-up through advanced policies. Transactional MFA is presented as an alternative using OIDC CIBA, but the source defers its detailed treatment."
---

# Step

[Okta](https://yomu.fyi/company/okta) · Indranil Jha · Oct 24, 2023

**Type:** Explainer

## Summary

Step-up authentication lets an application permit access to non-critical resources with basic authentication while requiring additional authentication for sensitive resources. The post describes how Okta Workforce Identity Cloud supports this pattern across modern OIDC applications and legacy integrations. For OIDC, applications use the /authorize endpoint’s acr\_values and max\_age parameters to request a mapped higher assurance level for a limited period, or prompt=login to force re-authentication each time. For non-OIDC applications, privileged Factor API operations can issue and verify challenges through a protected middleware layer using an Okta API token, while Okta Access Gateway can enforce step-up through advanced policies. Transactional MFA is presented as an alternative using OIDC CIBA, but the source defers its detailed treatment.

## Context

The subject is balancing frictionless access with stronger protection for sensitive resources. The source covers OIDC applications, non-OIDC applications using Factor APIs, legacy applications behind Okta Access Gateway, and transactional MFA as a related pattern.

## Approach / What changed

For OIDC, initiate a new authorization request with acr\_values and max\_age for temporary higher assurance, or prompt=login for forced re-authentication. For non-OIDC applications, use Factor API endpoints through a secure middleware or business layer, protecting the required static Okta API token. Okta Access Gateway can apply advanced policies to legacy header-authenticated applications.

## Takeaways

- OIDC step-up uses predefined acr\_values mapped to Workforce Identity Cloud assurance levels; custom acr\_values cannot currently be defined.
- Factor APIs can issue and verify challenges for non-OIDC applications, but privileged calls require protected server-side processing and a properly secured static Okta API token.
- Okta Access Gateway can enforce step-up for legacy web applications through advanced policies, while transactional MFA can use OIDC CIBA for approval-based access.

## FAQ

### How can an OIDC application avoid repeated step-up challenges?

The application can request a higher assurance level with acr\_values and specify max\_age. After successful step-up, the session remains at that assurance level for the stipulated duration, so later access within that period does not require another challenge.

### What is the difference between step-up and re-authentication-only?

Step-up requests additional authentication for a higher assurance level, potentially valid for a specified period. Re-authentication-only uses prompt=login in a new OIDC authorization request to force authentication even when an existing session is present.

### How do non-OIDC applications implement step-up authentication?

They can use Workforce Identity Cloud Factor APIs to find an enrolled factor, issue a challenge, and verify the response. A secure middleware or business layer must perform these privileged operations and protect the static Okta API token.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Okta](https://yomu.fyi/topic/okta), [OpenID Connect](https://yomu.fyi/topic/openid-connect)

- Source: [Okta](https://developer.okta.com/blog/2023/10/24/stepup-okta)
- Source URL: https://developer.okta.com/blog/2023/10/24/stepup-okta
- Ingested by Yomu: 2026-09-17T14:12:54.206Z

[Read original post](https://developer.okta.com/blog/2023/10/24/stepup-okta)