Okta mobile app

Mobile & screens

The Okta mobile app shows the user a set of service cards. Your app can expose a service that appears as a card inside it. This is declared per version — a later version can opt in without touching the original app.

Where to enable it

Partner dashboard → app → version → Integration tab → "Services inside the Okta mobile app" card → toggle it on, then provide the settings.

The three modes — pick one per version

Mode	What you ship	Where	Rendered as
`native`	Real Dart (Flutter)	`okta_app/native/<entry>/lib/`	A native UI inside the Okta app
`webview`	Web files	`okta_app/webview/`	A confined WebView
`external`	Nothing — you host it	An HTTPS URL of yours	A WebView on your URL

native is the only mode that gives you a native UI, and the only one that can reach device hardware through Okta.* calls. The other two go through the browser permission model, which the platform does not mediate.

Settings you provide

Setting	Description
mode	`native` (Dart code — a native UI), `webview` (web files in your repo) or `external` (a URL you host).
entry	`native`: a `.dart` file under `okta_app/native/<entry>/lib/`. `webview`: repo-relative path inside `okta_app/webview/`. `external`: full HTTPS URL.
min_contract	`native` only. The lowest host contract your code needs — per account type, under each row's entry in the Okta-app account-types list; a type without one inherits the block default, and the exported `mobile.minContract` mirrors the primary type.
allowed origins	External only: HTTPS origins the page may be loaded from.
required scope	Optional. The card is shown only if the user's active role holds this scope (from the scopes granted to the version). Empty = shown to any role that can open the app.
pass role claim	Optional, external only. Adds the role claim inside the signed JWT. No database access either way.

File structure (`webview` mode)

Put everything rendered in the mobile app inside a okta_app/webview/ folder at the root of your app repo:

mobile/
├── README.md
├── manifest.json        ← optional metadata for the mobile surface
├── screens/             ← entry files rendered in the WebView
│   └── dashboard.blade.php
└── assets/              ← css / js / images for those screens

Example entry: okta_app/webview/screens/dashboard.blade.php.

Policy (enforced)

Mobile services are confined to the dedicated okta_app/webview/ namespace:

The webview entry must be a repo-relative path inside okta_app/webview/ only — no http(s):// scheme, no .. traversal. Anything else is rejected at save/review time.
Mobile screens may not link, navigate, or redirect to any platform/tenant page outside the okta_app/webview/ namespace.
This is also enforced at runtime by okta-web's app.webview middleware (the mobile surface is fenced to the /app namespace).
In external mode you ship nothing here — you host the page, and isolation comes from allowed origins + zero data binding.

View the whole guide on one page · ↧ Raw Markdown