Okta Partners

Building your app

Embedded apps

Embedded apps live inside Okta but are forbidden from:

  • ✗ Importing App\Models\* (platform models)
  • ✗ Importing App\Services\* other than App\Services\PartnerApi\*
  • ✗ Reading platform env keys (DB_, REDIS_, etc.)
  • ✗ Reading .env directly

Use PartnerApi services exclusively. Each service automatically enforces its required scope. If the tenant hasn't granted your app that scope you'll get a MissingScopeException (HTTP 403).

You get a Postgres schema entirely separate from Okta's (m_<my_module>). PostgreSQL enforces the boundary at the role level.

Full boilerplate layout, the right way to access data, and tables guidance: see commit a164484 on prod.

View the whole guide on one page · ↧ Raw Markdown