Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls

This repository contains the source code for a Flask dashboard app that signs users in with Okta using OpenID Connect (OIDC), then uses the resulting OAuth 2.0 access token to call a separate backend API that only responds to authorized requests.

Please read Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls for a detailed walkthrough.

Features

• Securely sign users in and out using Okta as the OpenID Connect identity provider.
• Use Authlib to configure the Authorization Code flow with PKCE automatically.
• Allow new users to self-register for an account directly from the sign-in page.
• Call a protected API using scoped access tokens, validated on the backend.

Prerequisites

• A recent version of Python and pip installed (this project uses Python 3.14)

1. Sign up for a free Integrator Free Plan. If you already have an account, directly login to the Okta Developer Console.

2. Navigate to Applications > Create App Integration.

3. Choose:

   • Sign-in method: OIDC - OpenID Connect
   • Application type: Web Application

4. Fill in:

   • App name: (e.g., My Flask App)
   • Sign-in redirect URIs: http://localhost:5000/authorization-code/callback
   • Sign-out redirect URIs: http://localhost:5000
   • After creating the app, click the edit button under Client Credentials and enable Require PKCE as additional verification.
   • Copy the Client ID, Client Secret, and your Okta domain (used for the Okta Base URL). You will need these for the .env file.
   • Go to the Assignments tab, click Assign > Assign to Groups, search for Everyone, click Assign, then click Done.

5. Enable self-service registration (required for the self-registration feature to activate for your app):

   • Create a user profile enrollment policy. This policy defines the attributes a user must provide when self-registering.
   • Assign your application to the policy. Without this step, the self-service registration flow will not activate for your app.

6. Add a custom scope for the resource server:

   • Navigate to Security > API > Authorization Servers and select your authorization server.
   • Go to the Scopes tab, click Add Scope, enter api:read-users in the name field, and click Create.

7. Restrict the audience to your resource server:

   • In the same Authorization Server, go to the Settings tab and click Edit.
   • Change the Audience field to http://localhost:5001 and save.

Get the Code

1. Clone the repository

git clone https://github.com/oktadev/okta-flask-oauth-example.git
cd okta-flask-oauth-example

2. Configure the Environment File

Create a .env file in the root directory of your project and add the following environment variables:

OKTA_CLIENT_ID={yourClientId}
OKTA_CLIENT_SECRET={yourClientSecret}
OKTA_BASE_URL=https://{yourOktaDomain}
RESOURCE_SERVER_BASE_URL=http://localhost:5001

Run the Application

First, set up your virtual environment and install dependencies.

# Create a virtual environment
python3 -m venv venv


# Activate the virtual environment
# On macOS/Linux:
source venv/bin/activate
# On Windows:
venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

In your current terminal, start the main application on port 5000.

flask --app app.py run --port 5000

To start the Resource Server open a new terminal window. You must activate the virtual environment in this new window as well. After the virtual environment is active, use the following command to start the resource server.

flask --app resource-server.py run --port 5001

Open http://localhost:5000 in your browser.

If you see a home page that prompts you to login, then things are working! Clicking the Login button will redirect you to the Okta hosted sign-in page.

Note: If you are currently using your Okta Admin Console, you already have a Single Sign-On (SSO) session for your Org. You will be automatically logged into your application as the same user that is using the Admin Console. You may want to use an incognito tab to test the flow from a blank slate.

Links

This example uses the following resources:

• Self-Service Registration
• Token Validation
• Authorization Code flow with PKCE

Help

Please post any questions as comments on the blog post, or visit our Okta Developer Forums.

License

Apache 2.0, see LICENSE.