This is a prerequisite configuration before you deploy your online wallet. In this guide, we will walk you through the steps to configure Okta for your wallet and approver application. Okta provides a comprehensive identity platform that will enable secure authentication and authorization for your applications.

## Prerequisites

Before you begin, make sure you have the following prerequisites in place:

- Access to an Okta organization with administrator permissions. This can be a free Okta Developer Account or your company's existing Okta enterprise environment.
- The **API Access Management** feature must be enabled in your Okta organization to create a custom API resource (Authorization Server). This is included in Developer Accounts by default.
- Users and/or Groups created in your Okta organization that you can assign to the applications for testing. You can create users under **Directory > People**.

## Step 1: Create Required Resources

To configure Okta for your wallet and approver application, you need to create the following three resources in Okta:

1. **Single Page Application (SPA) Resource**  
   This resource will represent your wallet application, which typically runs in a web browser.
   1. Log in to the Okta Admin Console.
   2. Go to the **Applications > Applications** section.
   3. Click on the **Create App Integration** button.
   4. Select **OIDC - OpenID Connect** as the Sign-in method.
   5. Choose the **Single-Page Application** option for the Application type.
   6. Provide a name for your application (e.g., "Wallet App").
   7. Click **Save**. You will be taken directly to the application's settings page, where you can proceed with the configuration in Step 2.

2. **Native Application Resource**  
   This resource will represent your approver application, which runs natively on a device (e.g., mobile or desktop).
   1. In the Okta Admin Console, go to **Applications > Applications**.
   2. Click on the **Create App Integration** button.
   3. Select **OIDC - OpenID Connect** as the Sign-in method.
   4. Choose the **Native Application** option for the Application type.
   5. Provide a name for your application (e.g., "Approver App").
   6. Click **Save** to proceed to the application's settings page.

3. **API Resource (Authorization Server)**  
   This resource will represent the API that your applications will communicate with. In Okta, this is handled by a Custom Authorization Server.
   1. In the Okta Admin Console, go to **Security > API**.
   2. Click on the **Add Authorization Server** button.
   3. Provide a **Name** for your API (e.g., "Wallet API").
   4. Set the **Audience** to a unique URI for your API (e.g., `api://wallet-api`). This will be your API's unique identifier.
   5. Provide a **Description** (optional) and click **Save**.

## Step 2: Configure Application Settings

Once you have created the required resources, you need to configure the settings for each application.

### Configuring Wallet Application (SPA)

1. Navigate to the **Applications > Applications** section in the Okta Admin Console.
2. Select your wallet application (e.g., "Wallet App").
3. In the **General** tab, click **Edit**.
4. Configure the following settings:
   - **Grant type**: Ensure only the following is checked:
     - `Authorization Code` _(Note: Okta automatically applies the recommended Proof Key for Code Exchange (PKCE) security feature to all Single-Page Applications.)_
   - **Sign-in redirect URIs**: Add the full URL of your wallet front-end, ensuring it ends with `/login/callback` (e.g., `https://wallet.yourcompany.com/login/callback`).
   - **Sign-out redirect URIs**: Add the full URL of your wallet front-end (e.g., `https://wallet.yourcompany.com`).
   - **User consent**: Set to "Require consent" (this ensures users explicitly authorize the application).
5. Scroll down to the **Client Credentials** section:
   - Ensure **Client authentication** is set to **None** (public client).
6. Under **Login**, verify:
   - **Issuer** is set to **Dynamic** (allows the app to work with the appropriate authorization server).
7. **Assignments**: Assign the application to the appropriate users or groups under the **Assignments** tab.
8. Save your changes.

### Configuring Approver Application (Native)

1. Navigate to the **Applications > Applications** section in the Okta Admin Console.
2. Select your approver application (e.g., "Approver App").
3. In the **General** tab, click **Edit**.
4. Configure the following settings:
   - **Grant type**: Ensure the following are checked:
     - `Authorization Code`
     - `Refresh Token`
   - **Sign-in redirect URIs**: add entries for both approver apps:
     - `com.blockdaemon.reactnativeapproverapp://callback` (Mobile ApproverApp)
     - `app://./callback` (Desktop ApproverApp)
   - **Sign-out redirect URIs**: add entries for both approver apps:
     - `com.blockdaemon.reactnativeapproverapp://callback` (Mobile ApproverApp)
     - `app://./callback` (Desktop ApproverApp)
5. Scroll down to the **Client Credentials** section:
   - Ensure **Client authentication** is set to **None** (public client).
   - Check the box for **Require PKCE as additional verification**.
6. **Assignments**: Assign the application to the appropriate users or groups under the **Assignments** tab.
7. Save your changes.

## Step 3: Create an Access Policy (Link API to Apps)

You must create an Access Policy to grant your Wallet and Approver applications permission to use your API.

01. In the Okta Admin Console, navigate to **Security > API**.
02. Select your API resource (e.g., "Wallet API").
03. Go to the **Access Policies** tab and click **Add Policy**.
04. Give the policy a **Name** (e.g., "Wallet and Approver Access Policy") and a **Description**.
05. In the **Assign** to section, select **The following clients**.
06. Begin typing the names of your applications (e.g., "Wallet App" and "Approver App") and select them from the list.
07. Click **Create Policy**.
08. Now, within the policy you just created, click **Add Rule**.
09. Give the rule a **Name** (e.g., "Default Access Rule"), and configure:
    - Grant types allowed: Authorization Code
    - Scopes allowed: openid, email, profile
    - Access token lifetime: 60 minutes
    - Refresh token lifetime: Unlimited (rotation enabled)
    - Refresh token window: 90 days
    - People: include Everyone (or your target groups/users)
10. Click **Create Rule**.

Your applications are now authorized to request tokens from your API.

## Step 4: Finding Values for Your Apps

You will need the following values from your Okta configuration to set up your Wallet and Approver applications.

**Summary of Configuration Values** Use the list below to keep track of the critical values for your application configuration.

- **Okta Domain:**`[Enter your Okta domain URL here]`
  - _Location_: Your Okta organization URL (e.g., `https://dev-12345.okta.com`).
- **Wallet App Client ID:**`[Enter your Wallet App Client ID here]`
  - _Location_: Navigate to **Applications > Applications**, select your **Wallet App**, and find the ID on the **General** tab.
- **Approver App Client ID:**`[Enter your Approver App Client ID here]`
  - _Location_: Navigate to **Applications > Applications**, select your **Approver App**, and find the ID on the **General** tab.
- **API Audience:**`[Enter your API Audience URI here]` (default: `api://wallet-api`)
  - _Location_: Navigate to **Security > API**, select your API, and find the **Audience** value on the **Settings** tab.
- **API Issuer URI:**`[Enter your API Issuer URI here]`
  - _Location_: Navigate to **Security > API**, select your API, and find the **Issuer URI** on the **Settings** tab.