# \#authjs **URL:** https://devforum.okta.com/tag/authjs/42.md [Latest](https://devforum.okta.com/latest.md) · [Categories](https://devforum.okta.com/categories.md) · [Tags](https://devforum.okta.com/tags.md) --- ## [Okta Auth Js Future support and Development](https://devforum.okta.com/t/okta-auth-js-future-support-and-development/35103)
**Author:** [@punitsinghi](https://devforum.okta.com/u/punitsinghi)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 6:48am UTC](https://devforum.okta.com/t/okta-auth-js-future-support-and-development/35103 "2026-03-12T06:48:47Z")
We are planning to implement an Embedded Sign-In Flow for our website which is on OIE, and we see that Okta supports two primary approaches: Okta Sign-In Widget (SIW) Okta AuthJS Because we have significant cust… --- ## [Remove webcrypto-shim@0.1.7 & p-finally as security scan is throwing component end of life error](https://devforum.okta.com/t/remove-webcrypto-shim-0-1-7-p-finally-as-security-scan-is-throwing-component-end-of-life-error/35034)
**Author:** [@chaitanya.mula](https://devforum.okta.com/u/chaitanya.mula)\ **Replies:** 1\ **Last updated:** [February 10, 2026, 2:51pm UTC](https://devforum.okta.com/t/remove-webcrypto-shim-0-1-7-p-finally-as-security-scan-is-throwing-component-end-of-life-error/35034 "2026-02-10T14:51:52Z")
Hi team, I’m using @oktaokta/okta-auth-js in an enterprise project, and our security scan flagged a few deprecated and inactive transitive dependencies that come through the SDK. These are not direct dependencies in o… --- ## [Okta classic - how embedded signin is supposed to work with okta-auth-js](https://devforum.okta.com/t/okta-classic-how-embedded-signin-is-supposed-to-work-with-okta-auth-js/34650)
**Author:** [@jchabot86](https://devforum.okta.com/u/jchabot86)\ **Replies:** 1\ **Last updated:** [December 8, 2025, 4:23pm UTC](https://devforum.okta.com/t/okta-classic-how-embedded-signin-is-supposed-to-work-with-okta-auth-js/34650 "2025-12-08T16:23:09Z")
Is this expected behavior? We use a spa and built our own login form and using okta-auth-js APIs to authenticate. So, user visits the /login page (SPA initial page load occurs). User authenticates using signInWithRedi… --- ## [Cleanup of deprecated transitive dependencies in @okta/okta-auth-js](https://devforum.okta.com/t/cleanup-of-deprecated-transitive-dependencies-in-okta-okta-auth-js/34644)
**Author:** [@satya.nagendra](https://devforum.okta.com/u/satya.nagendra)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 3:17pm UTC](https://devforum.okta.com/t/cleanup-of-deprecated-transitive-dependencies-in-okta-okta-auth-js/34644 "2025-12-03T15:17:12Z")
Hi team, I’m using @okta/okta-auth-js in an enterprise project, and our security scan flagged a few deprecated and inactive transitive dependencies that come through the SDK. These are not direct dependencies in our c… --- ## [Okta-auth-js event expired firing late](https://devforum.okta.com/t/okta-auth-js-event-expired-firing-late/34416)
**Author:** [@jchabot86](https://devforum.okta.com/u/jchabot86)\ **Replies:** 0\ **Last updated:** [October 1, 2025, 2:02pm UTC](https://devforum.okta.com/t/okta-auth-js-event-expired-firing-late/34416 "2025-10-01T14:02:49Z")
We are attempting to handle our own token renewal. For the most part, when we receive the EVENT\_EXPIRED (‘expired’) event, we are able to then call tokenManager.renew(‘accessToken’). However, it seems like for a lot of… --- ## [Storing token in memory #authjs #react](https://devforum.okta.com/t/storing-token-in-memory-authjs-react/33915)
**Author:** [@Hamed](https://devforum.okta.com/u/Hamed)\ **Replies:** 0\ **Last updated:** [July 10, 2025, 5:53am UTC](https://devforum.okta.com/t/storing-token-in-memory-authjs-react/33915 "2025-07-10T05:53:50Z")
Hi, I’m using okta-auth-js and okta-react with pkce method in an SPA. The app is working fine, having ‘okta-token-storage\_accessToken’ and ‘okta-token-storage\_idToken’ stored in cookies. For some secturity reasons, I wa… --- ## [Okta Auth JS is continuously refreshing tokens even when the user is inactive on the browser tab](https://devforum.okta.com/t/okta-auth-js-is-continuously-refreshing-tokens-even-when-the-user-is-inactive-on-the-browser-tab/33367)
**Author:** [@rahul23](https://devforum.okta.com/u/rahul23)\ **Replies:** 1\ **Last updated:** [June 17, 2025, 3:10pm UTC](https://devforum.okta.com/t/okta-auth-js-is-continuously-refreshing-tokens-even-when-the-user-is-inactive-on-the-browser-tab/33367 "2025-06-17T15:10:51Z")
We’ve observed that @okta/okta-auth-js continues to refresh tokens in the background even when the user is inactive or the browser tab is not in focus. While this behavior aligns with the current configuration, it doesn’… --- ## [Okta-Auth-js with angular](https://devforum.okta.com/t/okta-auth-js-with-angular/33216)
**Author:** [@prashshyam](https://devforum.okta.com/u/prashshyam)\ **Replies:** 22\ **Last updated:** [June 4, 2025, 5:25pm UTC](https://devforum.okta.com/t/okta-auth-js-with-angular/33216 "2025-06-04T17:25:38Z")
Hi, I am using angular 19 with okta-auth0js 7.8.1.In my app am seeing that after one hour of activity okta idtoken is expiring and okta-auth-js is reauthenticating with okta and automatically redirecting the user to hom… --- ## [How can I validate the state param?](https://devforum.okta.com/t/how-can-i-validate-the-state-param/33141)
**Author:** [@arbnorlumezi](https://devforum.okta.com/u/arbnorlumezi)\ **Replies:** 3\ **Last updated:** [May 13, 2025, 1:13pm UTC](https://devforum.okta.com/t/how-can-i-validate-the-state-param/33141 "2025-05-13T13:13:22Z")
From my application I am able to add a url in state param as so: While using: GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API https://companyname.okta.com/oauth2/default/v1/authorize? client… --- ## [Retaining Authentication after App Update](https://devforum.okta.com/t/retaining-authentication-after-app-update/32977)
**Author:** [@richardshergold](https://devforum.okta.com/u/richardshergold)\ **Replies:** 3\ **Last updated:** [April 29, 2025, 6:52am UTC](https://devforum.okta.com/t/retaining-authentication-after-app-update/32977 "2025-04-29T06:52:37Z")
I have an Angular/Ionic/Capacitor app that uses the ionic-appauth library to handle it’s okta authentication. That library also uses the capacitor secure-storage plugin to store the okta access token locally. I’m wanti… --- ## [Implications on running okta-auth-js as a service - Logout is broken when service is not started](https://devforum.okta.com/t/implications-on-running-okta-auth-js-as-a-service-logout-is-broken-when-service-is-not-started/32952)
**Author:** [@Jessi](https://devforum.okta.com/u/Jessi)\ **Replies:** 0\ **Last updated:** [April 18, 2025, 3:02pm UTC](https://devforum.okta.com/t/implications-on-running-okta-auth-js-as-a-service-logout-is-broken-when-service-is-not-started/32952 "2025-04-18T15:02:36Z")
This question is related to the okta-auth-js sdk. I am seeing an error when calling authClient.signOut(). The error is an OAuth2 token revocation request invalid\_token error. I followed the tutorial at Sign users in to… --- ## [OAuthError:The client specified not to prompt, but the user is not logged in](https://devforum.okta.com/t/oautherror-the-client-specified-not-to-prompt-but-the-user-is-not-logged-in/32814)
**Author:** [@bajpaiayush](https://devforum.okta.com/u/bajpaiayush)\ **Replies:** 3\ **Last updated:** [April 4, 2025, 3:07pm UTC](https://devforum.okta.com/t/oautherror-the-client-specified-not-to-prompt-but-the-user-is-not-logged-in/32814 "2025-04-04T15:07:25Z")
Getting this issue when I try to renew access token. When token expires and request is made for renew, then this error comes up. Using @okta/okta-react and @okta/okta-auth-js plugins. This is happening across all browser… --- ## [Token Renewal Fails in PWA (React) on iPad, Leading to User Disconnection or Stuck Unauthenticated State](https://devforum.okta.com/t/token-renewal-fails-in-pwa-react-on-ipad-leading-to-user-disconnection-or-stuck-unauthenticated-state/32438)
**Author:** [@morfems](https://devforum.okta.com/u/morfems)\ **Replies:** 0\ **Last updated:** [March 1, 2025, 1:58am UTC](https://devforum.okta.com/t/token-renewal-fails-in-pwa-react-on-ipad-leading-to-user-disconnection-or-stuck-unauthenticated-state/32438 "2025-03-01T01:58:10Z")
I am using @okta/okta-auth-js and the token renewal sometimes fails in a PWA running on an iPad, even though refresh tokens are configured with the offline\_access scope. When this happens, the refresh token is deleted, l… --- ## [Issue with post activation redirects](https://devforum.okta.com/t/issue-with-post-activation-redirects/32386)
**Author:** [@Adrian\_Alm](https://devforum.okta.com/u/Adrian_Alm)\ **Replies:** 2\ **Last updated:** [February 28, 2025, 4:49pm UTC](https://devforum.okta.com/t/issue-with-post-activation-redirects/32386 "2025-02-28T16:49:57Z")
Greetings, I’m currently having a situation with a project I’m dealing with. I have a Nextjs app, that uses a custom login (signInWithCredentials) and I creating my users on a RestAPI using a direct call to Okta API on… --- ## [Okta-auth-js Magic Links to enroll Okta Verify](https://devforum.okta.com/t/okta-auth-js-magic-links-to-enroll-okta-verify/31715)
**Author:** [@cstaber](https://devforum.okta.com/u/cstaber)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 2:54pm UTC](https://devforum.okta.com/t/okta-auth-js-magic-links-to-enroll-okta-verify/31715 "2025-02-19T14:54:32Z")
We have our own sign in page that we are hosting that multiple applications will authenticate against using IDX/OIDC. When a user is required to enroll in factors, the SDK returns the list of factors and that is all work… --- ## [Handling Session Expiry and Improving User Experience in Passwordless Authentication Flow with Okta](https://devforum.okta.com/t/handling-session-expiry-and-improving-user-experience-in-passwordless-authentication-flow-with-okta/31664)
**Author:** [@Anugrah\_SR](https://devforum.okta.com/u/Anugrah_SR)\ **Replies:** 1\ **Last updated:** [January 27, 2025, 6:55am UTC](https://devforum.okta.com/t/handling-session-expiry-and-improving-user-experience-in-passwordless-authentication-flow-with-okta/31664 "2025-01-27T06:55:15Z")
We are implementing a passwordless authentication flow without MFA or security questions for both sign-in and sign-up using the Okta Identity Engine, the Okta SDK for Angular (@okta/okta-angular v6.2.0), and Auth JS (@ok… --- ## [Using okta-auth-js to silently hit the /authorize endpoint without also the /token endpoint](https://devforum.okta.com/t/using-okta-auth-js-to-silently-hit-the-authorize-endpoint-without-also-the-token-endpoint/31685)
**Author:** [@jchabot86](https://devforum.okta.com/u/jchabot86)\ **Replies:** 2\ **Last updated:** [January 16, 2025, 6:19pm UTC](https://devforum.okta.com/t/using-okta-auth-js-to-silently-hit-the-authorize-endpoint-without-also-the-token-endpoint/31685 "2025-01-16T18:19:27Z")
We have a use case to obtain an authorization code from a SPA using pkce. We’d like to do this silently, similar to getWithoutPrompt(). However, getWithoutPrompt() also exchanges the code for tokens. We just need the ifr… --- ## [Clarification on Resend Code Behavior During Temporary Lock in Passwordless Authentication Flow with Okta](https://devforum.okta.com/t/clarification-on-resend-code-behavior-during-temporary-lock-in-passwordless-authentication-flow-with-okta/31665)
**Author:** [@Anugrah\_SR](https://devforum.okta.com/u/Anugrah_SR)\ **Replies:** 0\ **Last updated:** [January 14, 2025, 2:58pm UTC](https://devforum.okta.com/t/clarification-on-resend-code-behavior-during-temporary-lock-in-passwordless-authentication-flow-with-okta/31665 "2025-01-14T14:58:18Z")
We are implementing a passwordless authentication flow without MFA or security questions for both sign-in and sign-up using the Okta Identity Engine, the Okta SDK for Angular (@okta/okta-angular v6.2.0), and Auth JS (@ok… --- ## [Customizing Password Reset Email URL for Self-Hosted Flow Using Okta Auth SDK](https://devforum.okta.com/t/customizing-password-reset-email-url-for-self-hosted-flow-using-okta-auth-sdk/31548)
**Author:** [@MogulDev](https://devforum.okta.com/u/MogulDev)\ **Replies:** 3\ **Last updated:** [December 24, 2024, 4:57pm UTC](https://devforum.okta.com/t/customizing-password-reset-email-url-for-self-hosted-flow-using-okta-auth-sdk/31548 "2024-12-24T16:57:00Z")
We are currently using Okta’s self-hosted Forgot Password widget. When a user clicks the link in the password reset email, they are directed to an Okta-hosted page where they can update their password (self-service flow)… --- ## [Cannot read properties of undefined (reading 'operators')](https://devforum.okta.com/t/cannot-read-properties-of-undefined-reading-operators/30148)
**Author:** [@Duncan](https://devforum.okta.com/u/Duncan)\ **Replies:** 21\ **Last updated:** [November 19, 2024, 2:56pm UTC](https://devforum.okta.com/t/cannot-read-properties-of-undefined-reading-operators/30148 "2024-11-19T14:56:28Z")
hi, I’ve converted our application from Jest to Vitest and most of the unit tests pass, but there are a number of them that fail, at the same time I’ve updated to the latest version of “@okta/okta-angular”: “^6.4.0”, … --- ## [Jsonpath-plus@6.0.1 Vulnerability](https://devforum.okta.com/t/jsonpath-plus-6-0-1-vulnerability/30895)
**Author:** [@matthewr](https://devforum.okta.com/u/matthewr)\ **Replies:** 3\ **Last updated:** [October 17, 2024, 5:56pm UTC](https://devforum.okta.com/t/jsonpath-plus-6-0-1-vulnerability/30895 "2024-10-17T17:56:50Z")
The @okta/okta-auth-js package currently utilizes ‘jsonpath-plus@6.0.1’. A vulnerability with this dependency just showed up in Snyk. Is this being addressed? jsonpath-plus@6.0.1: Remote Code Execution (RCE) \[Critical… --- ## [Refresh Token bugged](https://devforum.okta.com/t/refresh-token-bugged/30615)
**Author:** [@baro-san](https://devforum.okta.com/u/baro-san)\ **Replies:** 2\ **Last updated:** [September 27, 2024, 9:12am UTC](https://devforum.okta.com/t/refresh-token-bugged/30615 "2024-09-27T09:12:00Z")
I’m using the Okta React library and the refresh flow is completely broken. The autoRenew feature is also buggy and the library itself recommends to use getAccessTokenOrRefresh() for each request, disabling active refres… --- ## [Okta-Vue AuthSdkError: "Could not load PKCE codeVerifier from storage."](https://devforum.okta.com/t/okta-vue-authsdkerror-could-not-load-pkce-codeverifier-from-storage/30396)
**Author:** [@jakesov](https://devforum.okta.com/u/jakesov)\ **Replies:** 2\ **Last updated:** [September 24, 2024, 1:38pm UTC](https://devforum.okta.com/t/okta-vue-authsdkerror-could-not-load-pkce-codeverifier-from-storage/30396 "2024-09-24T13:38:44Z")
After registration, the user is to be redirected to the /welcome route. Occasionally, instead of displaying the component at that route, the following text is displayed where router-view component would appear on App.vue… --- ## [404 after login using HashLocation (# with en-US or fr) in prod](https://devforum.okta.com/t/404-after-login-using-hashlocation-with-en-us-or-fr-in-prod/30587)
**Author:** [@sabrinaBinaa89](https://devforum.okta.com/u/sabrinaBinaa89)\ **Replies:** 2\ **Last updated:** [September 20, 2024, 8:34am UTC](https://devforum.okta.com/t/404-after-login-using-hashlocation-with-en-us-or-fr-in-prod/30587 "2024-09-20T08:34:02Z")
Hi, I need your help, please :sob: Actually, my project is running correctly in local (dev) but in prod I have 404 not found after login: My objective is to redirect after login to https://domain.com/en-US/#/, I defin… --- ## [Okta store the key as value in the session storage instead of session info (JSON)](https://devforum.okta.com/t/okta-store-the-key-as-value-in-the-session-storage-instead-of-session-info-json/30607)
**Author:** [@tcs\_13](https://devforum.okta.com/u/tcs_13)\ **Replies:** 0\ **Last updated:** [September 17, 2024, 5:22pm UTC](https://devforum.okta.com/t/okta-store-the-key-as-value-in-the-session-storage-instead-of-session-info-json/30607 "2024-09-17T17:22:37Z")
We’re experiencing an intermittent issue where the okta-token-storage value in session storage gets replaced by a string (the key) instead of the session information in JSON format. This causes a JSON parsing error, brea… --- ## [400 bad request when login - redirection problem](https://devforum.okta.com/t/400-bad-request-when-login-redirection-problem/30437)
**Author:** [@sabrinaBinaa89](https://devforum.okta.com/u/sabrinaBinaa89)\ **Replies:** 5\ **Last updated:** [September 11, 2024, 12:18pm UTC](https://devforum.okta.com/t/400-bad-request-when-login-redirection-problem/30437 "2024-09-11T12:18:01Z")
Hi, I have a problem when I try to log in. I get bad requests with message ## Erreur : Le paramètre 'redirect\_uri' doit être un URI de redirection de connexion dans les paramètres de l'application cliente : https://de… --- ## [\[okta-auth-js\]: okta.idx.recoverPassword mostly completes but triggers Push Notification](https://devforum.okta.com/t/okta-auth-js-okta-idx-recoverpassword-mostly-completes-but-triggers-push-notification/30234)
**Author:** [@AdrianP](https://devforum.okta.com/u/AdrianP)\ **Replies:** 0\ **Last updated:** [August 26, 2024, 11:38pm UTC](https://devforum.okta.com/t/okta-auth-js-okta-idx-recoverpassword-mostly-completes-but-triggers-push-notification/30234 "2024-08-26T23:38:08Z")
Hi, I am building a React SPA with Typescript using the okta-auth-js package and I am creating a custom account creation, login, and password recovery pages. In the Admin Console, I have it set so that the following auth… --- ## [Using renewTokens results in an expired token after some time](https://devforum.okta.com/t/using-renewtokens-results-in-an-expired-token-after-some-time/30018)
**Author:** [@ashishbairwa](https://devforum.okta.com/u/ashishbairwa)\ **Replies:** 2\ **Last updated:** [August 21, 2024, 1:01pm UTC](https://devforum.okta.com/t/using-renewtokens-results-in-an-expired-token-after-some-time/30018 "2024-08-21T13:01:23Z")
Hi, team. I’m currently using okta auth release 5.1.1 in one of our app. For some reasons after some moment, when I call renew tokens I always get expired one. Attaching some screenshot to show current scopes in the proj… --- ## [Okta signInWithRedirect() function doesn't return user data](https://devforum.okta.com/t/okta-signinwithredirect-function-doesnt-return-user-data/29841)
**Author:** [@ShatKon](https://devforum.okta.com/u/ShatKon)\ **Replies:** 4\ **Last updated:** [August 8, 2024, 6:35am UTC](https://devforum.okta.com/t/okta-signinwithredirect-function-doesnt-return-user-data/29841 "2024-08-08T06:35:57Z")
Hi Okta Forum, I am having a ReactJS SPA and I am trying to create a SignIn functionality using Okta. Let me explain my use case: So when you launch the application it takes you to a Landing page. This landing page ha… --- ## [Okta AuthJS SDK: Unlock and Recover Password](https://devforum.okta.com/t/okta-authjs-sdk-unlock-and-recover-password/29462)
**Author:** [@jnortonbcbsm](https://devforum.okta.com/u/jnortonbcbsm)\ **Replies:** 0\ **Last updated:** [July 18, 2024, 9:09pm UTC](https://devforum.okta.com/t/okta-authjs-sdk-unlock-and-recover-password/29462 "2024-07-18T21:09:08Z")
Our organization currently uses the Okta AuthJS SDK for authentication using MFA (email/phone). We would like to also use the AuthJS SDK for self-service unlock and recover password. We currently don’t have separate fl… [Next page](https://devforum.okta.com/tag/authjs/42.md?match_all_tags=true&page=1&tags%5B%5D=authjs)