Enterprise single sign-on
Users authenticate through an Okta organization in a Next.js application.
Auth.js · Const
Okta
Okta is a built-in Auth.js OpenID Connect provider. Register it in your framework configuration and provide AUTH_OKTA_ID, AUTH_OKTA_SECRET, and AUTH_OKTA_ISSUER through environment variables.
How it works
The Okta provider is a built-in OpenID Connect integration. Add it to the framework's Auth.js configuration; Auth.js can infer its client ID, client secret, and issuer from the documented AUTH_OKTA_ID, AUTH_OKTA_SECRET, and AUTH_OKTA_ISSUER environment variables.
Syntax
OktaParameters
| Name | Type | Description |
|---|---|---|
options | OAuthUserConfig<P> | OAuth user configuration for the Okta profile, including values such as client ID, client secret, and issuer when supplied explicitly. |
Returns
OAuthConfig<P>
Key points
- Auth.js supplies Okta as a built-in provider rather than requiring a custom provider implementation.
- The documented environment-variable names cover the Okta client ID, client secret, and issuer.
- A Next.js deployment uses the Okta-specific callback path under
/api/auth/callback/okta. - The provider already includes defaults, so common setups need only register it and supply inferred credentials.
Common mistakes
- Configure Okta as OIDC; do not treat this built-in provider as a generic OAuth-only integration.
- Ensure the production callback URL is configured correctly, especially when the provider application permits only one callback URL.
Example: Register Okta with NextAuth
import NextAuth from "next-auth"
import Okta from "next-auth/providers/okta"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [Okta],
})With the documented AUTH_OKTA_* environment variables configured, this registers Okta as an authentication provider in a Next.js Auth.js application.
When to use it
OpenID Connect authentication
A service needs standard OIDC login without implementing discovery and authorization endpoints itself.
Environment-specific provider configuration
An application uses separate Okta tenants or deployment environments.
Interview questions
QHow do you add Okta to a Next.js Auth.js configuration?
Okta is registered through the built-in provider and added to the providers list. In a Next.js application, the documented setup uses Okta directly, while the provider-specific environment variables supply its credentials and issuer.
Follow-up: What callback URL should be configured? For Next.js, use https://example.com/api/auth/callback/okta, replacing the hostname with the deployed application's domain.
QWhich environment variables configure the Okta provider?
Set AUTH_OKTA_ID, AUTH_OKTA_SECRET, and AUTH_OKTA_ISSUER. Auth.js uses environment-variable inference, so the provider can be included without explicitly passing those values in the configuration.
Follow-up: What if inference is insufficient? Call the provider with options, such as Okta({ clientId, clientSecret, issuer }), to provide or override configuration explicitly.
QWhat does the Okta provider declaration return?
The provider factory accepts OAuth user configuration for an Okta profile and returns an OAuth configuration for that profile. The built-in defaults are intended for Okta's OpenID Connect setup.
Follow-up: How can a default be changed? Use the provider function with only the options that need changing; Auth.js deeply merges those overrides with the defaults.
Related
OAuthConfigOktaProfilecustomizing a built-in OAuth providerenvironment variable inferenceAuth.js OAuth providers