Authorization Code flow

• PKCE

resource "okta_app_oauth" "keycloak_idp" {
 label       = "Keycloak Identity Broker"
 type        = "web"  # This tells Okta it's a standard web app (OIDC)
 status      = "ACTIVE"

 # The exact endpoint where Okta sends the login token back to Keycloak
 redirect_uris = [
   "https://keycloak.yourexample.com/realms/your-realm-name/broker/okta-oidc/endpoint"
 ]

 # Keycloak handles the Authorization Code flow natively
 grant_types   = ["authorization_code"]
 response_types = ["code"]

 token_endpoint_auth_method = "client_secret_post"
 consent_method             = "TRUSTED"

 # CRITICAL FOR BASIC LICENSE: This configures the Org Auth Server to 
 # include the user's groups inside the ID Token so Keycloak can read it.
 groups_claim {
   name        = "groups"
   type        = "FILTER"
   filter_type = "REGEX"
   value       = ".*"  # Matches and passes all groups the user belongs to
 }
}

See also

• OAuth, Bearer Token, Scope, Google for authentication, PKCE, oAuth authorization flow, express-oauth-server, Authorization Code flow, /oauth2/default, okta_app_oauth, /oauth2/, OAuth 2.0 Authorization Framework, OAuth CLIs, oauth2c, Confidential client, Best practices