Okta sends the prompt=login parameter when using an Identity Provider (IdP) as an authentication factor to ensure the current authentication attempt satisfies the IdP factor rather than relying on a previous session. Because standard claims lack a timestamp, Okta requires this parameter to verify the authenticator remains active at the moment of the request. The external IdP requires configuration to handle the prompt=login parameter to satisfy the Multi-Factor Authentication (MFA) requirement.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• API Access Management
• Identity Provider (IdP) Authenticator
• OpenID Connect (OIDC)

Okta requires verification when an authentication flow uses an IdP as an authenticator. Because standard claims, such as the Authentication Methods Reference (AMR), omit a timestamp, Okta cannot verify whether the IdP authenticator satisfied the requirement during the current call or a previous session. Okta sends the prompt=login parameter to the IdP to ensure the authenticator remains active at the moment of the request.

Why does Okta send the prompt=login parameter?

This expected behavior maintains security assurance. The external IdP must handle the prompt=login parameter to satisfy the MFA requirement.

Review the authentication flow and configure the external IdP to handle the parameter by observing the following requirements.

• Observe that Okta includes prompt=login in the authorization request sent to the external OpenID Connect (OIDC) provider.
• Verify that the external IdP prompts the user for credentials or verification, even if an active session exists at that IdP.
• Configure the external IdP to handle the prompt=login parameter to satisfy the MFA requirement.

Related References

• Configure the IdP authenticator
• OpenID Connect Spec