Sporadic HTTP Error 400 When Signing In or Accessing the Okta Admin Console

A sporadic HTTP Error 400 occurs when signing in or accessing the Okta Admin Console due to client system clock drift or corrupted browser application storage. Synchronize the client machine clock and clear the browser application storage to resolve the error.

The user successfully authenticates into the standard Okta End-User Dashboard, but, when attempting to launch or sign in to the Okta Admin Console, the user completes Multifactor Authentication (MFA), and the Admin Console starts to load for a split second before immediately redirecting to a blank page or an HTTP Error 400 (Bad Request) screen. The issue may occur sporadically or persist for specific client workstations and browser sessions.

• Okta Identity Engine (OIE)
  
• Okta Admin Console
• Authentication
• Multifactor Authentication (MFA)

Okta authentication tokens, OpenID Connect (OIDC) assertions, and Security Assertion Markup Language (SAML) responses require strict timestamp synchronization. If the local system time deviates beyond the allowed time drift tolerance, token validation fails and Okta returns an HTTP 400 error. Additionally, stale session artifacts, cached Proof Key for Code Exchange (PKCE) state parameters, or expired Demonstrating Proof-of-Possession (DPoP) keys stored in browser storage can corrupt the step-up authentication handshake between the organization subdomain and the admin subdomain.

Synchronize the client machine clock.

Synchronize the client machine clock via Network Time Protocol (NTP) in the Windows settings.

1. Open the Windows Settings.
2. Navigate to Time & Language, and select Date & Time.
3. Locate Synchronize your clock under Additional settings, and select Sync now.
4. Confirm that the time synchronization status shows a successful checkmark.

What steps clear the browser application storage?

Clear the application storage and cached state for the primary tenant domain and the admin tenant domain in the browser developer tools.

1. Open the browser.
2. Press F12 or right-click anywhere and select Inspect to open the Developer Tools.
3. Select the Application tab in the top navigation bar of the Developer Tools.
4. Select Storage in the left-hand sidebar under Application.
5. Select the Cookies, Local storage, Session storage, IndexedDB, and Web SQL / Cache storage checkboxes.
6. Select Clear site data.
7. Repeat this process for both the primary tenant domain (https://<org>.okta.com) and the admin tenant domain (https://<org>-admin.okta.com).

Validate access in a clean session.

Validate access in a clean private browsing session to ensure the error is resolved.

1. Open a new InPrivate or Incognito window.
2. Navigate directly to the Okta organization URL.
3. Authenticate and proceed into the Admin Console to verify seamless access without error.