Okta
Okta is a platform in the Identity-as-a-Service (IDaaS) category. Okta features include Provisioning, Single Sign-On (SSO), Active Directory (AD) and LDAP integration, the centralized de-provisioning of users, multi-factor authentication (MFA), mobile identity management.
What detecting Okta tells you about a site
Okta is an enterprise identity and single-sign-on platform, and you catch it at the login boundary: a redirect to an *.okta.com / *.oktapreview.com tenant, the Okta sign-in widget loaded as a script, or Okta-issued session artefacts during SSO. Detecting it is a strong enterprise tell — Okta is the workforce-identity standard for medium-to-large organisations, so its presence usually means the application is internal, B2B, or sells into companies that mandate centralised SSO and access governance. It implies an IT/security function owning identity rather than a self-rolled auth flow.
Okta in a real-world stack
When you find Okta, it rarely travels alone. Pairs with SAML/OIDC-protected enterprise apps, a corporate directory, and often other workforce SaaS gated behind the same Okta tenant.
About
Okta is a platform in the Identity-as-a-Service (IDaaS) category. Okta features include Provisioning, Single Sign-On (SSO), Active Directory (AD) and LDAP integration, the centralized de-provisioning of users, multi-factor authentication (MFA), mobile identity management.
Categories: Authentication
Quick facts
Detection methodology for Authentication
Auth providers expose a script SDK and (usually) a hosted login endpoint. Auth0's `@auth0/auth0-spa-js` plus `*.auth0.com` redirects; Clerk's `@clerk/clerk-js` plus `clerk.<account>.lcl.dev`; NextAuth's `next-auth` package plus the `/api/auth/...` route handler. We catch each via the bundle and the network requests, plus the exact SDK version from the sourcemap.
How we detect Okta
Sourcemap Explorer carries 6 fingerprint signals for Okta, spread across 2 channels — javascript global and script src url. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Window-level global the technology installs on page. Reproducible by typing the path into the DevTools console.
window.OktaAuth
window.isOktaEnabled
window.okta.cdnUrlHostname
window.okta.locale
window.oktaCurrentSessionUrl
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
oktacdn\.com/.+/([\d.]+)/
FAQ
How do I check if a website is using Okta?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Okta's specific fingerprints here are javascript global and script src url, and the popup flags Okta whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Okta version can Sourcemap Explorer detect?
Okta ships as a hosted authentication rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
How much does Okta cost?
Okta's pricing model is documented as: poa, freemium, recurring. Detection is independent of the pricing tier — Sourcemap Explorer flags the technology by its fingerprints, regardless of which paid plan a site is on. See the official site for the current pricing page.
Where can I read more about Okta?
Official site: https://developer.okta.com. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Keep reading on Sourcemap Explorer
Practical guides
Detected by Sourcemap Explorer
Open the popup on any page running Oktaand you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.