Okta Certified Administrator · Part I

Security

20% of the exam — the third-largest domain.

Security

Module 1: Okta Security Policy & Enforcement Framework

7 sub-topics · this deck covers sub-topic 6 of 7

The Exam Bullet

"Demonstrate knowledge of authorization servers"

Securing API access isn't one setting — it's a stack of four separate mechanisms working together. Authorization servers are one piece of that stack.

The Mechanism — The Four-Part Stack

API Access Management is built from four mechanisms, layered for defense-in-depth:

Custom Authorization Servers — build tailored OAuth implementations
API Token Management — controls issuance and lifecycle of credentials
Trusted Origins — restricts requests to approved sources
API Rate Limits — throttles requests to prevent abuse

The Connection

The other two of these four (Token Management and Rate Limits) get their own dedicated modules later, in the API Functions section — this sub-topic is specifically about the Custom Authorization Server piece: building an OAuth setup tailored to your org's specific access control needs, instead of relying only on Okta's default behavior.

The Exam Angle

Watch for scenario questions built around this framing:

→ "An org needs OAuth scopes/claims customized beyond Okta's default setup." = a Custom Authorization Server, one of the 4 API Access Management mechanisms.

One Line To Remember

API Access Management = 4 mechanisms: Custom Authorization Servers (tailored OAuth), API Token Management, Trusted Origins, and Rate Limits. Authorization servers are the customization layer of that stack — token management and rate limits get their own dedicated modules later.

Sources: help.okta.com — API_Access.htm

Next: Sub 7 →