An Okta OpenID Connect (OIDC) web application lacks the Client Credentials grant type when the API Access Management feature add-on is absent. Administrators must purchase and enable the API Access Management feature to use custom authorization servers and custom scopes for the Client Credentials flow.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• API Access Management
• Web Applications

The Client Credentials flow lacks a user context, preventing the request of OpenID scopes. Administrators must create a custom scope to use this flow. Creating a custom scope requires a custom authorization server, which requires the API Access Management feature add-on. If the Okta environment lacks this add-on, the Client Credentials grant type remains unavailable for OIDC web applications.

How is the Client Credentials grant type enabled for an OIDC web application?

Acquire the API Access Management add-on to enable the Client Credentials grant type by contacting the appropriate Okta representative.

• Contact the designated Okta Account Manager to learn about pricing and add the feature.
• Contact the Okta Sales Team if an Account Manager is not assigned.

NOTE: When using the built-in Okta Organization Authorization Server, the Client Credentials flow only obtains Access Tokens that the Okta management endpoints can ingest.

Related References

• Okta App Integration Wizard OIDC
• API Access Management | Okta Pricing
• Okta Authorization Servers for OpenID Connect and OAuth 2.0 Integrations | Youtube OktaDev
• Custom Authorization Server Creation Restrictions - Customer FAQ
• Which authorization server should be used | Okta Developer
• Custom Authorization Server - Creating Custom Scopes
• Implement OAuth for Okta with a service app