Okta Network Restrictions for OAuth Token Endpoint

By default, Okta Authentication Policies restrict network access during user login flows but do not apply network zone restrictions to token-specific endpoints. Administrators observe that requests to token generation, introspection, and revocation endpoints succeed even when originating from outside the allowed network zones defined in the authentication policy. Administrators resolve this by enabling the Network Restrictions for OAuth Token Endpoint feature, which enforces per-application network boundaries across all token endpoints and Management APIs.

• Okta Identity Engine (OIE)
• Okta Classic
• Network Zones
• OAuth 2.0
• OpenID Connect (OIDC)

How do administrators apply network zones within application settings?

Navigate to the application settings in the Okta Admin Console and define the allowed network zones or IP addresses in the Sign On tab.

1. In the Oka Admin Console, navigate to Applications and select Applications.
2. Select the target application.
3. Navigate to the General tab.
4. Locate the Network section and define the allowed network zones or IP addresses.
5. Save the configuration.

Okta Restricts Specific Endpoints After Administrators Configure Network Zones

Okta enforces the configured network zone boundaries across the following OAuth 2.0, OpenID Connect, and Management API endpoints.

• Token generation via the /token endpoint.
• Token introspection via the /introspect endpoint.
• Token revocation via the /revoke endpoint.
• Access token usage against the /userinfo endpoint.
• Access token usage against the Okta Management API endpoints.