When implementing the Native to Web SSO (Native2WebSSO) flow, a user receives an invalid_target error when making a POST request to the /oauth2/v1/token endpoint using the Token Exchange grant type. This occurs because the audience parameter in the token exchange request is either absent or incorrectly formatted. Including the audience parameter constructed with the specific URN format resolves the issue. When this failure occurs, Okta generates the following error response:

{
  "error": "invalid_target",
  "error_description": "Token Exchange requests must include a valid audience of the authorization server."
}

• Okta Identity Engine (OIE)
• Native to Web SSO (Native2WebSSO)
• Web Application

The audience parameter in the token exchange request is either absent or not formatted in the URN format that Okta expects for the Native2WebSSO flow. Okta requires the audience to explicitly reference the target Web Application using a specific urn:okta:apps: prefix.

How is the invalid target error resolved in a Native2WebSSO token exchange flow?

Resolve the invalid_target error by passing the audience parameter in the correct URN format, using the Client ID of the target Web Application.

1. In the Okta Admin Console, go to Applications > Applications and open the target Web Application.
2. On the General tab, copy the Client ID.
3. In the token exchange request to /oauth2/v1/token, include the audience parameter constructed as urn:okta:apps:<Client_ID>.

Related References

• Interclient Token Exchange