Okta Certified Administrator · Part I

API Functions

6% of the exam — the smallest domain, but a real one.

API Functions

Module 1: Token Management

1 sub-topic · this deck covers the whole module

The Exam Bullet

"Demonstrate knowledge of how to create API tokens with the correct permissions"

An API token isn't its own independent credential — it's tied directly to the person who created it, for better and worse. This sub-topic is about what that actually means operationally.

The Mechanism

API tokens are generated with the permissions of the user that created the token. Whoever's account made it, that's the access level the token carries — nothing more, nothing less.

Roles that can create tokens: super admins, org admins, group admins, group membership admins, and read-only admins.

The Gotcha — Use a Service Account

Generate API tokens using a service account that won't be deactivated and that has super admin permissions that won't change.

This is the real operational risk: a token created by a regular employee's account stops working the moment that person is deactivated — even if the integration itself is still needed.

The Lifecycle

Valid for 30 days · auto-renews with each API use · unused 30+ days = automatically revoked · rejected entirely if the creator's account is deactivated

Security Configuration

Admins can restrict where a token operates by specifying network zones or IP addresses at creation time — allowing or blocking connections from specific locations.

The Exam Angle

Watch for scenario questions built around this trap:

→ "An integration stopped working right after an employee left the company." = the API token was tied to that employee's account, not a service account — exactly the risk the best practice warns against.

One Line To Remember

API tokens inherit their creator's permissions (super/org/group/group-membership/read-only admins can create them). Best practice: use a stable service account, not a regular employee's account. Tokens last 30 days, auto-renew on use, auto-revoke after 30 days unused, and die if the creator is deactivated. Can be restricted to specific network zones/IPs.

Sources: help.okta.com — API.htm

✓ Module 1: Token Management — complete (1 of 1 sub-topic)