Configure apps for multiple user types

Create persona specific OIDC apps for Okta admins and end users with required scopes following the principle of least privilege.

About this task

Early Access release

If your Okta org requires different permission levels for different user types, create separate OIDC apps:

  1. For Okta admins: Follow OpenID Connect (OIDC) with Proof Key for Code Exchange (PKCE) or Private key JWT to create an app integration, and grant management scopes such as okta.users.manage.
  2. For end users: Follow OpenID Connect (OIDC) with Proof Key for Code Exchange (PKCE) or Private key JWT to create an app integration, and grant limited scopes such as okta.governance.accessRequests.read.

Share the appropriate client ID with each user group. This ensures each user has access only to the permissions they need, following the principle of least privilege.