Identity Providers like Okta try to help you via multiple support systems. Still, it can feel like a lot of work. As part of authentication, your client application makes multiple calls to an authorization server, and you get back several strings, which are tokens.
OAuth 2. Authentication verifies the identity of who you claim to be, and authorization verifies you have access to data you want to see or actions you want to perform.
It is lightweight with less effort to set up and use than Security Assertion Markup Language SAML , an alternate authentication and authorization mechanism that pre-existing systems may use.
For example, different OAuth 2. A confidential client such as a traditional server-rendered web app can keep super secret information such as a Client Secret for authorization.
The client application starts the process and generates a random, long string β the code verifier. Then it creates a code challenge from the code verifier. This step is part of the PKCE extension. The client application holds on to the code verifier. It then makes an authorization code request to your authorization server, in this case, represented by Okta.
