Guidance For Okta Workflows API Endpoints Without Authentication
Last Updated:
Overview
Okta Workflows has a feature that allows administrators to expose flows as public API endpoints without authentication. As a best practice, Okta strongly recommends not using unauthenticated endpoints for production flows. Exposing an endpoint without authentication means anyone with the Invoke URL can trigger the flow. Administrators should not include sensitive information in public workflow responses.
Applies To
- Okta Workflows
Solution
How can administrators identify unauthenticated API triggered flows?
- Open the Okta Workflows console.
- Navigate to and open a flow that uses an API Endpoint card.
- Select the three dots in the bottom right of the API Endpoint card, and select Endpoint settings.
- Review the Security level setting to determine if it is set to None (public service).
Following best practices
If an unauthenticated endpoint is required to satisfy a business need, administrators must carefully design the tasks and responses to prevent data exposure. Anyone possessing the API endpoint URL can perform the actions configured in the flow.
Review these security best practices for building public flows to limit data exposure and unauthorized system changes:
1. Restrict destructive actions:
Do not include cards that delete users, reset passwords, or modify critical system configurations.
2. Limit data exposure:
Ensure the flow response does not return sensitive information, such as personally identifiable information (PII), API keys, internal system details, or other sensitive details.
As a best practice, Okta recommends explicitly defining your workflows’ responses to minimize the data returned to only what is necessary. See our guidance on Controlling the Response Returned by an Okta Workflows Flow.
3. Validate and sanitize inputs:
If the flow accepts incoming data, limit the actions the flow performs based on the provided input to ensure payloads do not trigger unintended system behavior.
4. Modify or disable risky flows:
If a public workflow contains PII, API keys, internal system details, or other sensitive details, revise the flow to remove the data or disable public access immediately.
How do administrators secure an API endpoint to disable public access?
If a flow requires access control or contains sensitive data, administrators can secure the endpoint using OAuth 2.0 or a client token. Secure the flow by configuring the endpoint security settings and selecting an authentication method.
- Open the Okta Workflows console and navigate to the specific flow.
- Select the three dots in the bottom right of the API Endpoint card, and select Endpoint settings.
- Follow the steps to configure either OAuth 2.0 or use a client token:
Administrators can secure an endpoint with OAuth 2.0.
An OAuth 2.0 flow requires an API service integration to trigger the endpoint. Creating an API service integration application is the ideal way to invoke a secured flow. The application exists solely to invoke the flow and return the output to the invoking request. Configure the API service integration from the Applications page in the Admin Console.
How do administrators secure an endpoint with a client token?
A client token flow requires the calling server to provide a specific token to Okta. When switching a flow to this security level, Okta recommends regenerating the client token for security reasons. Pass the provided client token as a value in the x-api-client-token HTTP header. Ensure the external calling application removes the clientToken query parameter from the URL when using the header.
