Okta Authorization Error Custom Scopes Are Not Allowed for This Request
Last Updated:
Overview
An authorization error occurs when requesting custom scopes from the Okta Org Authorization Server because it only supports standard OpenID Connect (OIDC) and Okta Application Programming Interface (API) scopes. Administrators must route the authorization call through a Custom Authorization Server to resolve this issue. When attempting to make an /authorize call to Okta, the request fails, and Okta sends the following error message to the configured redirect_uri:
Custom scopes are not allowed for this request.
Error example:
Additionally, Okta logs an event in the System Log containing the following failure message:
This error typically occurs when using an authorization URL targeting the Org Authorization Server, as shown in the example below.
Note that there is a custom scope called "someCustomScope" being used in this authorize request:
https://{OktaDomainNAme}/oauth2/v1/authorize?
client_id={clientId}&
response_type=code&
scope=openid someCustomScope&
redirect_uri=http://localhost:8080/authorization-code/callback&
state=state-123
This same error can also occur when the Client Credentials flow is being used. In this case, it is a call to the /token endpoint that contains the custom scope instead for the /authorize call.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- API Access Management (API AM)
- OpenID Connect (OIDC)
Cause
This error occurs because the request asks for custom scopes from the Okta Org Authorization Server. The Org Authorization Server only supports standard OIDC scopes and Okta API scopes. Because administrators cannot configure custom scopes within the Org Authorization Server, including them in the scope parameter of the /authorize or /token request causes the validation to fail.
Solution
How are custom scopes requested successfully?
Route the /authorize or /token call through the Custom Authorization Server where the specific custom scope resides by formatting the URL as shown in the following example:
https://{OktaDomainName}/oauth2/{customAuthorizationServerId}/v1/authorize?
client_id={clientId}&
response_type=code&
scope=openid someCustomScope&
redirect_uri=http://localhost:8080/authorization-code/callback&
state=state-123
NOTE: Custom Authorization Servers require the API AM feature. If the Authorization Servers tab is missing under Security > API in the Okta Admin Console, the Okta org does not have the API AM feature.
