A WireMock simulation of Okta's REST API — covering authorization, token issuance, introspection, revocation, and OIDC discovery.
A shared instance of this template runs on a public endpoint — call it right now from curl, an SDK, or an AI agent. Responses are fixed examples and behavior can't be changed; rate limits apply.
Jump to the endpoints ↓Run this template as a mock API in WireMock Cloud for a private instance you control — edit stubs, add stateful scenarios, use dynamic response templating, and inspect requests in the log.
Open in WireMock Cloud (free) →Live sandbox · no signup, no API key
A running WireMock Cloud instance of this template, callable right now from a terminal, a script, or an AI agent.
Endpoints
GET OpenID Connect discovery document
curl -s -X GET 'https://05374.wiremockapi.cloud/.well-known/openid-configuration'GET Get Okta's public JWKS
curl -s -X GET 'https://05374.wiremockapi.cloud/oauth2/v1/keys'POST Revoke a token
curl -s -X POST 'https://05374.wiremockapi.cloud/oauth2/v1/revoke'Spec catalog — Okta OAuth2/OIDC Mock API (1.0.0) · 8 endpoints
| Method | Path | Summary |
|---|---|---|
| GET | /.well-known/openid-configuration | OpenID Connect Discovery |
| GET | /oauth2/v1/authorize | Authorization Endpoint |
| POST | /oauth2/v1/introspect | Token Introspection Endpoint |
| GET | /oauth2/v1/keys | JWKS Endpoint |
| GET | /oauth2/v1/logout | Logout Endpoint |
| POST | /oauth2/v1/revoke | Token Revocation Endpoint |
| POST | /oauth2/v1/token | Token Endpoint |
| GET | /oauth2/v1/userinfo | UserInfo Endpoint |
Unauthenticated WireMock Cloud demo sandbox for Okta — not an official Okta sandbox, and it returns simulated example data only.
The template models Okta's org authorization server — the /oauth2/v1 endpoint family, discovery document included. Its token endpoint is the centerpiece: the access token it issues is a decodable JWT populated with Okta's characteristic claims (sub, cid, uid, scp, and the sandbox's own URL as iss), so middleware that decodes Okta tokens to make authorization decisions has realistic material to work with.
Okta clients are configured by issuer, and custom domains mean the SDKs accept any host there — so the sandbox origin drops straight into okta-auth-js:
Backend services follow the same pattern — an Okta JWT verifier or generic OIDC middleware configured with the sandbox as issuer will fetch the discovery document and keys from the mock. Substitute your own copy's URL to control token claims and lifetimes.
The payoff shows up wherever login is a prerequisite rather than the subject: integration tests that need a signed-in state, services that gate on scopes inside the access token, and local development that shouldn't require an Okta org, an app registration, or a live tenant's rate budget.
import OktaAuth from "@okta/okta-auth-js";
// issuer points at the mock instead of
// your-org.okta.com; clientId is never validated
const authClient = new OktaAuth({
issuer: "https://05374.wiremockapi.cloud",
clientId: "any-value",
redirectUri: window.location.origin + "/callback",
});
await authClient.token.getWithRedirect({
responseType: "code",
});It knows nothing about you — client ids, redirect URIs, and secrets are accepted unexamined. That erases the usual prerequisite of registering an application in an Okta admin console before the first request can succeed.
They carry real RS256 signatures from the mock's own key, published at /oauth2/v1/keys. A verifier told to trust the sandbox as issuer validates them cleanly; the claims inside are fixed sample values — a mock user and a static scope set — rather than anything you configured.
The endpoints cover the authorization-code path end to end — authorize, token, userinfo, logout — plus the token-management pair, introspection and revocation. Anything needing Okta-specific extensions beyond these routes calls for stubs of your own in a private copy.
Not on the shared instance — its profile payload is one fixed mock identity. Cloning the template into WireMock Cloud makes the claims editable per stub, which is how you'd test authorization branches for different user roles or for missing profile fields.
Vendor names identify APIs represented by WireMock template sources. This page does not imply vendor endorsement, certification, partnership, or official integration status.