# Programmatically using Okta to authenticate with external app **URL:** \ **Category:** OAuth/OIDC\ **Tags:** api\ **Created:** [January 11, 2019, 5:06pm UTC](https://devforum.okta.com/t/programmatically-using-okta-to-authenticate-with-external-app/3861 "2019-01-11T17:06:55Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![anthonyw](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/anthonyw/32/879_2.png) [@anthonyw](https://devforum.okta.com/u/anthonyw)\ **Post date:** [January 11, 2019, 5:06pm UTC](https://devforum.okta.com/t/programmatically-using-okta-to-authenticate-with-external-app/3861/1 "2019-01-11T17:06:55Z")
I’m quite new to SAML and Okta, but I believe that we’re using Okta as an IdP in a federated login system. I would like to use a certain user’s Okta credentials to (programmatically) obtain a SAML assertion from Okta that can be used to get an OAuth2.0 token from an external service (a SP in SAML parlance, I think). I have examples (through a saml-tracer dump) of this flow happening from a browser’s perspective, but in that case the SAML assertion from Okta is encoded in some way, embedded in a hidden form, and then autosubmitted (to a different endpoint on the external service than what I need to obtain OAuth2.0 tokens). What are the steps that I should follow to achieve the same thing in a programmatic way? I.e. what endpoints should I be hitting, and what is the protocol for obtaining a SAML assertion that 1) isn’t embedded in a hidden HTML form and 2) can be passed on to the external service and used for authentication with OAuth2.0? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 12, 2024, 7:08pm UTC](https://devforum.okta.com/t/programmatically-using-okta-to-authenticate-with-external-app/3861/2 "2024-02-12T19:08:37Z")
Closed on February 12, 2024, 7:08pm UTC