When an application passes a custom scope to the Okta Org Authorization Server, Okta generates an authorization error because the Org Authorization Server does not support custom scopes. To resolve this issue, configure the application to use a Custom Authorization Server, which requires the API Access Management (API AM) feature. Okta returns the following error to the callback route during the authorize request:
error=invalid_scope&error_description=Custom scopes are not allowed for this request
Additionally, Okta logs an event in the System Log containing the following failure reason:
Custom scopes are not allowed for this request
- Okta Identity Engine (OIE)
- Okta Classic Engine
- API Access Management (API AM)
- Custom Authorization Server
- OAuth 2.0/OpenID Connect (OIDC)
The Okta Org Authorization Server (https://<okta_domain>/oauth2/v1/authorize) only supports Okta-defined scopes and does not support custom scopes. Passing a custom scope to the Org Authorization Server results in an error. Only a Custom Authorization Server supports custom scopes.
To fix this error, configure the application to use a Custom Authorization Server instead of the Org Authorization Server. The default Custom Authorization Server URL is https://<okta_domain>/oauth2/default/v1/authorize.
If using a specific Custom Authorization Server, the URL format is https://<okta_domain>/oauth2/<custom_authorization_server_id>/v1/authorize.
NOTE: Custom Authorization Servers require the API Access Management (API AM) feature. If the Authorization Servers tab is missing under Security > API in the Okta Admin Console, the Okta org does not have the API AM feature.
To verify the availability of Custom Authorization Servers and resolve the error, navigate to the API settings in the Okta Admin Console and update the application configuration.
- Navigate to Security > API in the Okta Admin Console.
- Verify that the Authorization Servers tab is present.
- Update the application configuration to use a Custom Authorization Server URL instead of the Org Authorization Server URL.
