Is it easy or difficult to use our developer documentation? Let us know in this short survey ↗

    On this page

    Create an API token

    This guide explains what an API token is, why you need one, and how to create one.

    Learning outcomes

    • Learn how an Okta API token is used.
    • Understand why it's good practice to create a service account for use with an API token.
    • Know the alternatives to Okta API tokens.
    • Find out when a token expires and what happens when it expires.
    • Find out how API tokens are deactivated.

    What you need

    Okta Developer Edition organization (opens new window)

    Okta API tokens

    Okta API tokens are used to authenticate requests to Okta APIs. When calling an Okta API endpoint, you need to supply a valid API token in the HTTP Authorization header, with a valid token specified as the header value. You need to prefix the value with the SSWS identifier, which specifies the proprietary authentication scheme that Okta uses. For example:

    Authorization: SSWS 00QCjAl4MlV-WPXM...0HmjFx-vbGua

    Privilege level

    Different Okta API operations require different admin privilege levels. API tokens inherit the privilege level of the admin account that is used to create them. It’s therefore good practice to create a service account to use when you create API tokens. With a separate service account, you can assign specific privilege levels to your API tokens. See Administrators (opens new window) for admin account types and the specific privileges of each.

    OAuth 2.0 instead of API tokens

    As an alternative to Okta API tokens, you can use Okta APIs. You can use a scoped OAuth 2.0 access token for various Okta endpoints. Each access token enables the bearer to perform specific actions on specific Okta endpoints, with that ability controlled by which scopes the access token contains. For more information, see the OAuth for Okta guide.

    Create the token

    See Create Okta API tokens (opens new window) to create an API token and define the network zones that API calls can originate from.

    Note: Record the token value. This is the only opportunity to see it and record it.

    Token network restrictions

    You can specify a network range for every SSWS API token. The tokens only work if API requests are made from the specified IP or network range. You can specify network zones while you create an API token. You can also modify an existing token to specify a network range.

    See Manage Okta API tokens (opens new window) for steps on creating API tokens and editing network restrictions for an existing API token.

    Token rate limits

    When API tokens are created, the rate limit for each token interaction is set automatically to 50 percent of each API maximum limit. See API rate limits. You can adjust this percentage by editing the Token rate limits section. See Set token rate limits (opens new window).

    Token expiration and deactivation

    Tokens expire automatically after a certain period and can also be deactivated at any time.

    Token expiration

    Tokens are valid for 30 days from creation or last use, so that the 30 day expiration automatically refreshes with each API call. Tokens that aren't used for 30 days expire. The 30-day period is fixed and can't be changed for your org.

    Token deactivation

    If a user account is deactivated in Okta, any API token created by that user account is deprovisioned at the same time.

    Next steps

    With the token created, you can begin using it, supplying it in the Authorization header of calls to Okta API endpoints. See Sign users into your SPA using the redirect model for a functional example.

    See also

    Edit This Page On GitHub