Skip to main content

Okta

The supplied source material does not contain a verified Okta console walkthrough for this AIGW flow. This page therefore describes the required contract only.

Required capabilities​

Your Okta authorization server would need an equivalent mechanism to:

  • trust the AIGW ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays.'s issuer and ES256 JWKSJWKSJSON Web Key Set: a published set of public keys used to verify JWT signatures. for the user assertion;
  • authenticate the AIGW client using asymmetric JWT client authentication for the supplied private_key_jwt pattern;
  • accept the intended assertion audience;
  • expose/authorize the AIGW-requested scope names;
  • map the assertion subject to an Okta/merchant user or provision one;
  • mint an access token the merchant backend accepts.

Configuration inputs​

Collect from the AIGW Resource:

AIGW per-resource issuer
AIGW per-resource JWKS URL
Client ID
Resource indicator / audience
Requested scopes
Merchant AS issuer + token endpoint

Validation requirement​

Confirm the exact Okta grant and client-authentication features available in your tenant before implementation. The supplied material does not provide enough evidence for a click-by-click Okta procedure, so this guide intentionally does not fabricate one.