Enforce Network Restrictions for OAuth Token Endpoints in Okta

Okta Authentication Policies restrict network access during user login flows but do not apply network zone restrictions to token-specific endpoints by default. Requests to token generation, introspection, and revocation endpoints succeed even when originating from outside the allowed network zones defined in the authentication policy. Administrators resolve this by enabling the Network Restrictions for OAuth 2.0 Token Endpoint feature to enforce per-application network boundaries across all token endpoints and Management APIs. 

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Network Zones
• OAuth 2.0
• OpenID Connect (OIDC)

How do administrators apply network zones within application settings?

Navigate to the application settings in the Okta Admin Console and define the allowed network zones or IP addresses in the General tab.

1. In the Okta Admin Console, navigate to Applications and select Applications.
2. Select the target application.
3. Navigate to the General tab.
4. Locate the Network section and define the allowed network zones or IP addresses.
5. Save the configuration.

Okta restricts specific endpoints after administrators configure network zones.

Okta enforces the configured network zone boundaries across the following OAuth 2.0, OpenID Connect (OIDC), and Management API endpoints.

• Token generation via the /token endpoint.
• Token introspection via the /introspect endpoint.
• Token revocation via the /revoke endpoint.
• Access token usage against the /userinfo endpoint.
• Access token usage against the Okta Management API endpoints.