Configuring applications or Identity Providers (IdPs) that use OpenID Connect (OIDC) for authentication requires the OpenID Connect Well-Known URL. Identifying the authorization server type and formatting the URL with the Okta domain and authorization server ID provides the necessary metadata document URL.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• Org Authorization Server
• Custom Authorization Server

How is the OpenID Connect Well-Known URL formatted in Okta?

Gather the required Okta domain and authorization server ID, identify the authorization server type, and format the URL accordingly.

• Gather the Okta domain (for example, <example.okta.com>).
• Gather the Custom Authorization Server ID, if applicable. Locate this unique identifier in the Okta Admin Console under Security > API > Authorization Servers.
• Format the URL for an Org Authorization Server by replacing <OKTA_DOMAIN> with the Okta domain:

https://<OKTA_DOMAIN>/.well-known/openid-configuration

• Format the URL for a Custom Authorization Server by replacing <OKTA_DOMAIN> with the Okta domain and <AUTHORIZATION_SERVER_ID> with the Custom Authorization Server ID:

https://<OKTA_DOMAIN>/oauth2/<AUTHORIZATION_SERVER_ID>/.well-known/openid-configuration

NOTE: If using the default Custom Authorization Server, the ID is typically default:

https://<OKTA_DOMAIN>/oauth2/default/.well-known/openid-configuration

Related References

• • Retrieve the OpenID Connect metadata (Org Authorization Server)
  • Retrieve the OpenID Connect metadata (Custom Authorization Server)
  • Okta Developer Documentation - Authorization Servers Concepts
  • Okta Developer Documentation - OpenID Connect & OAuth 2.0 API
  • Okta Developer Documentation - Find your Okta domain