Okta Workflows Error "Failed to authenticate request. Please check your headers" When Invoking API Endpoint Secured With OAuth 2.0
Last Updated:
Overview
A 401 error occurs when invoking a flow with an API endpoint using OAuth 2.0, through a third party, or when testing via Postman or Workflows, as shown in Invoke and Test an OAuth 2.0 Secured API Endpoint. This happens when an Okta org uses a single custom domain for authentication, but the configuration for the audience value and token endpoint uses the default Okta domain. Resolve this issue by updating the audience value and token endpoint to use the custom domain instead of the default Okta domain.
Failed to authenticate request. Please check your headers
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Workflows
- Custom Domain
- OAuth 2.0 API Endpoints
- Invoke a flow with an API endpoint using OAuth 2.0
Cause
This error occurs when an Okta org tied to Workflows uses a single custom domain for authentication, but the configuration in the Workflow for the JSON Web Token (JWT) audience value and the token endpoint uses the default domain. If the Okta org uses a single custom domain, Workflows expects authentication to occur via that custom domain.
NOTE: If there is no Custom Domain or more than one Custom Domain (Workflows would not know which to associate with), the default Okta domain would be used. See Workflows Console Required to Authenticate Custom Domain for more information on the Custom Domain behavior.
Solution
How is the authentication request error resolved?
Update the audience value and the token endpoint to use the custom domain instead of the default Okta domain to ensure Workflows authenticates correctly.
- Verify the audience value configured for the JWT.
- Verify the token endpoint URL used to request a token.
- Update both values to use the custom domain instead of the default Okta domain (for example, use
<login.example.com>instead of<orgname.okta.com>).
