Okta supports Request for Comments (RFC) 8707 (Resource Indicators for OAuth 2.0), allowing clients to explicitly signal the intended target resource to the authorization server during a token request. This capability prevents security issues that arise when an authorization server issues a token without a specific recipient, particularly when configuring authorization servers to support multiple Multi-Cloud Provisioning (MCP) servers. Administrators require the ability to use the resource parameter to swap Audience claims and specify absolute URL resource indicators in authorization and token requests.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OAuth 2.0
• API Access Management
• Utilizing the resource Parameter to Swap Audience Claims

How does Okta support the resource parameter and audience switching?

Okta supports dynamic audience switching and the resource claim as defined in RFC 8707. Clients explicitly signal the intended target resource to the authorization server during the token request. By including an absolute URL resource indicator parameter in the authorization and token requests, clients inform the authorization server exactly which MCP server requires access. This explicit signaling addresses ambiguity and prevents security vulnerabilities associated with issuing tokens without a specific recipient.

Related References

• Okta Custom Authorization Server Information  
• Okta's OpenID Connect Request Parameters 
• RFC8707: Resource Indicators for OAuth 2.0