Okta rejects token exchange requests containing only a subject token with a missing_token_request_parameter error when the organization lacks the On-Behalf-Of Token Exchange capability. To resolve this error, customers contact Okta Support to enable the On-Behalf-Of Token Exchange capability for the organization. Without this capability, Okta defaults to delegation mode and requires both the subject_token and actor_token parameters.

missing_token_request_parameter

• Okta Identity Engine (OIE)
• API Access Management (API AM)
• OAuth 2.0 On-Behalf-Of Token Exchange (RFC 8693)

A request for On-Behalf-Of Token Exchange (RFC 8693) can fail because the required feature is not enabled in the organization. This feature requires the API Access Management (API AM) SKU. Without this capability, Okta operates only in delegation mode, which requires both the subject_token and actor_token parameters. Okta rejects requests that contain only the subject_token and returns a missing_token_request_parameter error. Additionally, Okta omits the AuthorizationServerAudience in the System Log.

How does an administrator enable On-Behalf-Of Token Exchange?

When Okta enables the On-Behalf-Of Token Exchange capability, Okta operates in Subject-Token-Only mode, making the actor_token parameter optional while still supporting delegation mode. Customers need to contact Okta Support and provide the required information to enable the On-Behalf-Of Token Exchange capability 

1. Contact Okta Support and request to enable the On-Behalf-Of Token Exchange capability for the organization.
2. Provide the Org ID, a business justification, and reference On-Behalf-Of Token Exchange (RFC 8693).

System Logs Confirm the Active Capability

Test the token exchange request and verify the System Log to confirm the active capability.

1. Make a token exchange request with only the subject_token parameter and omit the actor_token parameter.
2. Include the audience, subject_token_type, and requested_token_type parameters in the request.
3. Verify that Okta returns a 200 OK success response.
4. Navigate to Security and select System Log.
5. Locate the test request and check the Debug Context to verify that Okta populates the AuthorizationServerAudience field.

Related References

• Set up OAuth 2.0 On-Behalf-Of Token Exchange | Okta Developer