Configure Okta for agent IAM

Enterprise

Appropriate Vault Enterprise license or HCP Vault Dedicated cluster required.

Use Okta with Vault Enterprise agentic IAM to secure AI workflows using Okta-issued credentials with authorization codes or client credential grant types.

Before you start

You must have an Okta Integrator account to configure the authorization server for agents.
To generate tokens from client credentials, you must have an Okta Platform account with the non-human identities (NHI) feature available. The free integrator account trial does not support NHI.
You must have the oauth2c CLI. You need oauth2c installed and in your system PATH to interact with OAuth 2.0 authorization servers.
You must have curl or some other tool to make API calls.
You must have jq installed to use the example commands as written.

Step 1: Create the OIDC service app

Create and configure Okta with a Service App and default authorization server.

Create new App Integration

Open the Okta admin console.
Click Applications and Resources.
Click Create App Integration.
Select OIDC - OpenID Connect.
Select Web Application.
Click Next.
Under General Settings, enter a name for your application in App integration name.
Select Client Credentials.
Select Refresh Token.
Select Token Exchange.
Set Sign-in redirect URIs to the default callback URL for oauth2c: http://localhost:9876/callback so you can test the token exchange later.
Select Allow everyone in your organization to access.
Select Enable immediate access with Federation Broker Mode.
Click Save.
Save the Client ID and Client secret values from the general settings page. You need the client values to validate the agent workflow later:
```
$ export \
    OKTA_CLIENT_ID="<your_client_ID>"
    OKTA_CLIENT_SECRET="<your_client_secret>"
```

Step 2: Configure an Authorization Server policy

Create an Authorization Server policy and associate the policy with your new application.

Select default authorization server

Click Security.
Click API.
Click default to open the setting screen for your default authorization server.
Select the Settings tab.
Copy the Okta URL value in parentheses from Issuer and save it to an environment variable for use later:
```
$ export OKTA_URL=`<Okta URL copied from previous step>`
```
Select the Access Policies tab.
Click Add Policy.
Enter a name for your new policy Name, for example Vault Agentic IAM.
Add a useful description for the policy in the Description field.
For Assign to, click The following clients and enter the name of the application you created.
Click Create Policy.
Click Add rule.
Enter a name for the rule into Rule Name, for example, AI default access.
Click to enable the Authorization Code checkbox.
Click to enable the Device Authorization checkbox.
Click Advanced to expand the options.
Click to enable the Token Exchange checkbox.
Leave all other settings at their default values.
Click Create rule.

Step 3: Create a Vault read scope

Use your application settings, authorization server, and default rules to configure an authorization server scope. We recommend starting with a minimal scope for reading secrets from Vault.

Add scope

From the default authorization server API page, click Scopes.
Click Add Scope.
Enter vault.read into Name.
Enter a human-friendly phrase like Vault Read into Display phrase.
Click Implicit.
Click to check Set as default scope.
Click Create.

Step 4: Validate token retrieval

Use your application URL, client ID, and client secret values with the oauth2c tool to get a token from Okta as a validation step.

Use the oauth2c command-line tool to request an example token using the Okta authorization code workflow:

$ oauth2c "${OKTA_URL}" \
    --pkce                                             \
    --client-id "${OKTA_CLIENT_ID}"                    \
    --client-secret "${OKTA_CLIENT_SECRET}"            \
    --response-types code                              \
    --response-mode query                              \
    --grant-type authorization_code                    \
    --auth-method client_secret_basic                  \
    --no-browser

Vist the URL provided under Go to the following URL: in a browser to complete the authentication flow. Confirm Okta completed the token exchange in the command line output:
```
...snip...
 SUCCESS  Obtained authorization code
...snip...
SUCCESS  Exchanged authorization code for access token
```
The final output string after access_token represents the JWT value, which validates both the workflow and token issuance from Okta.
Export the access_token value to the JWT_ACCESS_TOKEN environment variable.
```
$ export JWT_ACCESS_TOKEN="<access_token_returned_by_okta>"
```

Use the oauth2c command-line tool to request an example token using the Okta client credentials workflow:

$ oauth2c  ${OKTA_URL}                \
--client-id ${OKTA_CLIENT_ID}         \
--client-secret ${OKTA_CLIENT_SECRET} \
--grant-type client_credentials       \
--auth-method client_secret_basic     \
--response-mode query                 \
--response-types code                 \
--scopes okta.myAccount.manage        \
--pkce                                \
--no-browser

The final output string after access_token represents the JWT value, which validates both the workflow and token issuance from Okta.

Export the access_token value to the JWT_ACCESS_TOKEN environment variable.
```
$ export JWT_ACCESS_TOKEN="<access_token_returned_by_okta>"
```

After you configure Vault, you can use the JWT_ACCESS_TOKEN value to authenticate your agent with Vault for secret access.

Step 5: Save your data for next steps

Confirm your app details from the setup process. To configure Vault agentic IAM, you must have the following information:

Value	Environment variable	Description
Issuer URL	ISSUER	Okta URL from issuer settings
Client ID	EXTERNAL_ID	Client ID value for your OIDC application
Client secret value	SECRET_ID	Client secret value for your OIDC application
Key endpoint	JWKS_URI	URL where clients can download public keys (JWKS). The OKTA_URL + "/v1/keys"

We recommend setting the following environment variables to make Vault configuration more convenient:

$ export                                 \
    VAULT_ADDR="<your_vault_server_url>" \
    VAULT_TOKEN="<token_string>"         \
    EXTERNAL_ID="<global_obj_guid>"      \
    SECRET_ID=<app_secret_obj_guid>      \
    JWKS_URI="<jwks_uri>"                \
    ISSUER="<issuer>"

For example:

$ export                                                                  \
    VAULT_ADDR="https://127.0.0.1:8200"                                   \
    VAULT_TOKEN="hvs.000000000000000000000000"                            \
    EXTERNAL_ID="00000000000000000000"                                    \
    SECRET_ID="3333333333333-3333-3333-333333333333"                      \
    JWKS_URI="https://integrator-0000000.okta.com/oauth2/default/v1/keys" \
    ISSUER="https://integrator-0000000.okta.com/oauth2/default"

Next steps

Configure Vault to secure agentic workflows
Configure additonal identity provides and authentication servers: