The "typ" Field is Missing from the Access Token Header
Last Updated:
Okta Classic Engine
Okta Identity Engine
API Access Management
Overview
This article explains why sometimes Access Tokens have the "typ" filed in the header, and why sometimes it is missing.
Applies To
- Custom Authorization Servers
Cause
The "typ" field is missing from the header because the Access Token is generated by a Custom Authorization Server. This is the expected behaviour.
Solution
The "typ" field is only included in Access Tokens that are generated by the Org Authorization Server.
Such tokens can only be consumed or validated by Okta, and the value of this field can be subject to unannounced changes and updates, as it is not documented.
The expected structure for access tokens generated by a Custom Server can be found in the Access Token documentation.
Find more about the differences in server types in Available authorization server types.
