Options for Okta Inline Authentication Without Redirection in Okta Identity Engine
Last Updated:
Overview
Applications require authentication without redirecting to an Okta-hosted login page in Okta Identity Engine (OIE). Implement the Interaction Code flow or the Direct Authentication Application Programming Interface (API) to achieve inline authentication. The Interaction Code flow allows Okta to drive authentication state and policy-based remediation, while Direct Authentication provides full control over the user interface for native login experiences.
Applies To
- Okta Identity Engine (OIE)
- Embedded Authentication
- Interaction Code Flow
- OpenID Connect (OIDC)
Solution
What is the Interaction Code flow option?
Implement the Interaction Code flow when Okta must drive authentication state, policy-based remediation, and token issuance. This occurs through the pre-built Okta Sign-In Widget or a fully custom user interface built on the Okta Auth JavaScript (JS) Software Development Kit (SDK).
Review the following limitations before implementing the Interaction Code flow.
- Building a fully custom user interface directly on the Interaction Code flow requires handling every authentication and remediation state (identify, select-authenticator, challenge-authenticator, enrollment).
- Missing a state causes affected users to get stuck mid-flow, as a partial-coverage option does not exist.
- Embedding the Okta Sign-In Widget provides the same no-redirect experience with the Interaction Code flow already implemented, requiring significantly less effort than building directly against the Okta Auth JS SDK.
The Direct Authentication API Provides a Native Login Experience
Implement the Direct Authentication API for native login experiences that require full control over the user interface. This allows direct authentication against Okta via OAuth 2.0 or OIDC grant types without adopting the Interaction Code state machine.
Review the following limitations before implementing the Direct Authentication API.
- Direct Authentication does not support all Okta authenticator types.
- The Configure Direct Authentication page maintains supported combinations.
- Verify the current supported list before committing to this approach, as the list changes frequently and might not cover every authenticator the policy requires.
- Enabling Direct Authentication grant types requires Super Admin permissions.
- Direct Authentication shifts more responsibility to the client or backend for securely collecting and transmitting credentials.
- Factor this into the compliance posture if handling raw passwords or One-Time Passwords (OTP) client-side.
- Enable the custom authorization server OTP grant type manually unless using the organization authorization server.
