Hi, we've implemented Okta using the okta-react package in conjunction with the okta-jwt-verifier-python package. The frontend is sending requests, with access tokens attached to the headers, to the backend where a decorator implementing okta-jwt-verifier-python verifies the attached JWT before allowing the request to proceed. It works great.

What we want to do next is allow certain users direct access to our API through an SDK we're developing using some sort of token. We were thinking of using access tokens, however we can get them, since the decorator already works.

I've looked into generating access tokens with an Okta API token but that doesn't seem possible and this document (https://support.okta.com/help/s/article/How-to-get-tokens-for-an-OIDC-application-without-a-browser-using-curlPostman?language=en_US) has managed to confuse me. Where do I get the "code_verifier" value from?

Can we avoid passing credentials for our API users in any way and get something like an anonymous access token?

What are our options?