# Okta Emulator (service host)

Create an instance:
curl -s -X POST https://okta.emulators.dev/_emulate/instances
# Hosted deployments create instances lazily when the returned URL is first used. The instance URL is a capability: anyone who has it can read and modify the instance, so save the returned URLs. Never store real secrets in an emulator.
# The server generates an unguessable name. An optional {"instance":"<prefix>"} body adds a readable prefix.

Then use the returned providerBaseUrl / controlBaseUrl. Example below uses a sample instance.
# Okta Emulator

Stateful Okta OAuth, OpenID Connect, users, groups, apps, and authorization server emulator.

Provider base URL: https://okta.your-instance.emulators.dev
Control base URL: https://okta.your-instance.emulators.dev/_emulate

Supported surfaces:
- Management API: partial at /api/v1
- Okta OAuth 2.0: supported at /oauth2
- OpenID Connect: supported at /.well-known

Control endpoints:
- https://okta.your-instance.emulators.dev/_emulate/manifest
- https://okta.your-instance.emulators.dev/_emulate/coverage
- https://okta.your-instance.emulators.dev/_emulate/connections
- https://okta.your-instance.emulators.dev/_emulate/state
- https://okta.your-instance.emulators.dev/_emulate/ledger
- https://okta.your-instance.emulators.dev/_emulate/faults
- POST https://okta.your-instance.emulators.dev/_emulate/credentials
- POST https://okta.your-instance.emulators.dev/_emulate/seed
- POST https://okta.your-instance.emulators.dev/_emulate/reset

Fault injection:
Arm a one-shot provider failure with a glob pathPattern, then inspect /ledger for faulted: true.
curl -s -X POST https://okta.your-instance.emulators.dev/_emulate/faults \
  -H "content-type: application/json" \
  -d '{"match":{"method":"GET","pathPattern":"/v1/*"},"response":{"status":503,"body":{"error":"temporary"}}}'

Connect:

## Okta Auth JS (TypeScript)
import { OktaAuth } from "@okta/okta-auth-js";

const authClient = new OktaAuth({
  issuer: "https://okta.your-instance.emulators.dev/oauth2/default",
  clientId: "<client_id>",
  redirectUri: "http://localhost:3000/callback",
  scopes: ["openid", "profile", "email"],
});

## Okta issuer (env)
OKTA_ORG_URL=https://okta.your-instance.emulators.dev
OKTA_ISSUER=https://okta.your-instance.emulators.dev/oauth2/default
OKTA_CLIENT_ID=<client_id>
OKTA_CLIENT_SECRET=<client_secret>
OKTA_API_TOKEN=<token>

## curl
curl -s https://okta.your-instance.emulators.dev/oauth2/default/.well-known/openid-configuration

## Base URL (env)
OKTA_BASE_URL=https://okta.your-instance.emulators.dev

## Create a credential
curl -s -X POST https://okta.your-instance.emulators.dev/_emulate/credentials \
  -H "content-type: application/json" \
  -d '{"type":"oauth-authorization-code"}'

## Inspect requests
curl -s https://okta.your-instance.emulators.dev/_emulate/ledger