The expected audience for tokens from this provider
OptionalclientOAuth client ID for this provider (used by OAuth proxy for upstream auth)
ProtectedconfigOptionaldomainProvider domain hosting the OAuth endpoints when they aren't on the issuer (used by OAuth proxy)
The issuer URL for this provider (must match the 'iss' claim in tokens)
ProtectedjwksThe JWKS endpoint URL for retrieving signing keys
Unique name identifier for this provider
Gets the signing key for token verification with retry logic
Checks if a given issuer URL belongs to this provider
Validates Okta-specific configuration
StaticConfigConfigures Okta from OKTA_DOMAIN + OKTA_CLIENT_ID, with OKTA_ISSUER overriding the issuer for orgs that use a custom authorization server rather than the default one.
NEW capability: Okta had no env-var form before the discovery hook existed — it was one of the providers the old hard-coded block did not cover, so it required a config-file entry.
Okta authentication provider implementation