Okta Certified Developer study plan
Okta Certified Developer · Give each week a clear focus.
8 weeks · About 6 hours per week
Okta APIs and SDKs
Map the Okta API surface: list the core endpoints for Users, Groups, Apps, and Sessions and note which HTTP methods and scopes each requires
Obtain an API token from a free Okta developer org and authenticate a raw HTTP request with the SSWS Authorization header
Build a Postman or curl collection that performs GET, POST, PUT, and DELETE on a user resource with correct Content-Type and Accept headers
Explain Okta rate limits, the X-Rate-Limit headers, and the 429 response with Retry-After, and describe how to back off
Your checkpoint
A working API collection checked into a Git repo with a README documenting each endpoint, method, scope, and a sample request/response for user create, read, update, and deactivate
Okta APIs and SDKs & User Management and Lifecycle
Install the Okta Java or Node SDK and create, update, and deactivate a user programmatically
Paginate a user list using the Link header or cursor-based pagination and handle the next-page URL correctly
Implement error handling that distinguishes 400 validation errors, 401 auth failures, 403 scope failures, 404 not-found, and 429 rate limits
Use the Users API search parameter syntax (profile.firstName eq "...") and explain its limitations versus the Search API
Your checkpoint
A small CLI or script that lists users with pagination, creates a test user, updates a profile attribute, and deactivates the user, with structured error handling and a passing smoke test
Authentication and Authorization
Contrast OIDC authorization code with PKCE, client credentials, and device code flows and pick the correct flow for a SPA, a web app, and a machine-to-machine service
Configure an OIDC app in the developer org and complete an authorization code + PKCE flow end to end, exchanging the code for tokens
Decode and validate an ID token and access token: verify signature, issuer, audience, expiry, and nonce
Explain scopes, claims, and the difference between ID token claims and access token claims
Your checkpoint
A working PKCE flow demo (web or script) that logs in, exchanges the code, validates the ID token signature and claims, and prints a decoded token comparison table
Authentication and Authorization & User Management and Lifecycle
Implement token refresh and silent re-authentication, handling expired access tokens and revoked refresh tokens
Configure and test an inline hook (e.g., token or user import) or an event hook and describe the request/response contract
Set up a group and group rule that auto-assigns users by profile attribute, then verify membership changes
Explain the difference between authentication policy, MFA enrollment policy, and global session policy and where each applies
Your checkpoint
A group rule plus policy configuration documented with screenshots and a test script that proves a new user is auto-assigned to the correct group and challenged for MFA
Application Integration and SSO
Configure SAML 2.0 SSO between Okta and a sample app, mapping attributes and configuring the ACS URL and audience
Explain the SAML assertion structure, NameID formats, and how to debug signature or clock-skew failures
Set up an OIDC web app integration with the SDK, including callback route, state handling, and logout
Compare SAML versus OIDC for a given app requirement and justify the choice
Your checkpoint
Two working SSO integrations (one SAML, one OIDC) against the same sample app, with a written comparison of setup steps, attribute mapping, and failure modes
Application Integration and SSO & User Management and Lifecycle
Implement single logout and session management: Okta session cookie behavior, /logout endpoint, and post-logout redirect validation
Configure an app assignment model (individual, group, or rule-based) and verify access is denied when a user is unassigned
Use the Apps API to read app metadata, assign a group to an app, and list a user's assigned apps
Describe how provisioning (SCIM) differs from SSO and configure basic SCIM user push to a test app
Your checkpoint
A test user whose app access is driven entirely by group membership, with an automated check that unassigning the group removes access and a SCIM push log showing create and deactivate events
User Management and Lifecycle & Okta APIs and SDKs
Automate the full lifecycle: create user, activate, assign groups, update profile, suspend, unsuspend, deactivate, and delete via API
Implement a profile mapping or attribute transformation between an external source and Okta universal directory
Handle deprovisioning edge cases: users with active sessions, app assignments, and staged versus active status transitions
Design idempotent lifecycle scripts that can be safely re-run and log outcomes
Your checkpoint
An idempotent lifecycle automation script with unit tests covering create through delete, plus a state-transition diagram documenting allowed status changes
Okta APIs and SDKs & Authentication and Authorization & Application Integration and SSO & User Management and Lifecycle
Review weak areas by re-doing one hands-on task from each domain without notes
Practice explaining rate-limit handling, token validation, SAML debugging, and lifecycle state transitions aloud in exam-style phrasing
Complete a timed 60-question self-made practice set covering all four domains and review every miss
Clean up the developer org and archive all repos and notes for reference
Your checkpoint
A scored practice exam with a written remediation list for every missed question and a final one-page cheat sheet covering endpoints, flows, and lifecycle states
Milestones
Week 2: Can authenticate to the Okta API, page through users, and handle 401/403/429 errors without looking up syntax
Week 4: Can complete an authorization code + PKCE flow from scratch and validate the resulting tokens, and can explain where authentication, MFA, and session policies apply
Week 6: Has two working SSO integrations (SAML and OIDC) and can debug an assertion or token failure using logs alone
Week 8: Scores at least 80% on the timed practice set and has a written remediation plan for remaining gaps