okta-token-fetcher

Provides a commandline script and package for getting an OKTA id_token by interacting with your browser via the commandline.

This script builds off of the dirty quick way to get a token from your browser stated here: https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#get-an-access-token-and-make-a-request .

This is done by opening a browser window that navigates to the auth server with localhost as the redirect_uri. There is an http server that is spun up for just long enough to handle the redirect request and get the id_token from the query parameters that are sent via window.hash (I suppose OKTA does this so that it can't be sent to the server itself). Tokens are cached in the OS keyring unless --no-cache is set.

Your OKTA application MUST have "http://localhost:8888" configured as one of the allowed redirect uri's for this tool to work.

As a terminal script:

usage: okta-fetch [-h] -i ISSUER -c CLIENT_ID [-s SCOPES] [-t TOKEN_TYPE] [--no-cache] [-S KEYCHAIN_SERVICE] [-u KEYCHAIN_USERNAME] [-r FINAL_REDIRECT] [-I]

options:
  -h, --help            show this help message and exit
  -i ISSUER, --issuer ISSUER
                        The auth server url. This should be only the domain and protocol. eg: https://mydomain.okta.com
  -c CLIENT_ID, --client-id CLIENT_ID
                        The client id to get a token for
  -s SCOPES, --scopes SCOPES
                        Comma delimited list of scopes to request
  -t TOKEN_TYPE, --token-type TOKEN_TYPE
                        The type of token to request
  --no-cache            Don't cache the token
  -S KEYCHAIN_SERVICE, --keychain-service KEYCHAIN_SERVICE
                        Service name to use when caching tokens to the OS keychain. Defaults to the issuer
  -u KEYCHAIN_USERNAME, --keychain-username KEYCHAIN_USERNAME
                        Username to use when caching tokens to the OS keychain. Defaults to the client ID
  -r FINAL_REDIRECT, --final-redirect FINAL_REDIRECT
                        This is where the browser will be redirected to at the end of the auth flow
  -I, --info            Print info about the token

    This script builds off of the dirty quick way to get a token from your browser stated here:
    https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#get-an-access-token-and-make-a-request .

    This is done by opening a browser window that navigates to the auth server with localhost as the redirect_uri. There
    is an http server that is spun up for just long enough to handle the redirect request and get the token from the
    query parameters that are sent via window.hash.

    Your OKTA application MUST have "http://localhost:8888" configured as one of the allowed redirect uri's for this tool to work.

Implemented in another script:

fetcher = OktaToken(
    issuer="https://my-okta-org.okta.com/8a88fje02348ljajr8,
    client_id=my-oidc-app-client-id,
    final_redirect="https://github.com",
    token_type="token",
    use_keychain=True,
)
print(fetcher.token)