This article describes the behavior of JSON Web Encryption (JWE) tokens for OpenID Connect (OIDC) applications. The encryption behavior for access and ID tokens differs depending on whether an Org Authorization Server or a Custom Authorization Server is used.

• OpenID Connect (OIDC)
• JSON Web Encryption (JWE)
• Authorization Servers
• Okta Identity Engine (OIE)

The token encryption behavior is determined by the type of Authorization Server in use.

• Org Authorization Server

  • The access token is not encrypted.

  • The ID token is encrypted.

• Custom Authorization Server

  • The access token is encrypted using the keys configured on the Authorization Server.

  • The ID token is encrypted only if the application requesting token encryption is enabled. The ID token is encrypted using the keys configured in the application.
    
    

NOTE: Introspect, Revoke, and UserInfo endpoints do not work with encrypted access tokens.

Related Articles

• Encrypt OIDC ID tokens for app integrations
• Encrypt access tokens for authorization servers