Can Okta be used for an API that will be accessed programmatically?

user_2891081 0
Viewed 669

I am trying to understand if the following scenario can be accomplished using an Okta developer account. I want to secure an API written in Python/Flask that is meant to be accessed programmatically by another backend service. No user interaction. So far, all I am able to find are tutorials where a user is redirected to a login screen and must manually enter credentials.

I was thinking maybe I could call the http://USERNAME.okta.com/api/v1/authn endpoint. I did this with Postman and successfully authenticated and was given a session ID. Can this session ID be used to access an API endpoint I have written that is protected with the "@login_required" decorator?

Ideally I would like the flow to be something along the lines of this.

  1. Service A wants to consume my Okta protected API.
  2. Service A calls an endpoint providing credentials it has stored somewhere secure. (The user never sees a login screen / enters credentials / even is aware of the Okta protected API's existence)
  3. My Okta protected API authenticates the credentials via Okta and provides back a bearer token.
  4. Service A then provides this token when making requests to the Okta protected API

I've seen this flow plenty of times when developing against third party API's. Is it possible to accomplish this with Okta? if so, could someone point me to an example of how this can be done?

Thank you

okta
1 Answers

Many grant flows can be used to authenticate an application instead of a user. You could use the client credentials flow for instance.

See Okta documentation for more details.

Here is a sample in python using requests-auth (authentication classes to be used with requests). If you are using httpx instead of requests you can use httpx-auth.

import requests
from requests_auth import OktaClientCredentials


okta = OktaClientCredentials(instance='testserver.okta-emea.com', client_id='54239d18-c68c-4c47-8bdd-ce71ea1d50cd', client_secret="secret")
requests.get('http://www.example.com', auth=okta)
user_43984380
Related