Verify Implicit Flow Usage in the Okta System Log

Administrators can verify if applications use the OAuth 2.0 Implicit flow by querying the Okta System Log. Okta retains System Log data for 90 days, so the search window is limited to this timeframe.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System Log
• OAuth 2.0 Implicit Flow

How is the Okta System Log queried for Implicit flow usage?

Navigate to the System Log in the Admin Console and execute a specific query to identify applications using the Implicit flow.

1. Open the Okta Admin Console.
2. Go to Reports, and then select System Log.
3. Enter the following expression into the search field: 

   eventType eq "app.oauth2.authorize.implicit.id_token" 
   OR eventType eq "app.oauth2.as.authorize.implicit.id_token" 
   OR eventType eq "app.oauth2.authorize.implicit.access_token" 
   OR eventType eq "app.oauth2.as.authorize.implicit.access_token"

4. Select the search icon or press Enter.

System Log retention limits restrict searches to 90 days.

Okta retains System Log events for up to 90 days. Administrators cannot query Okta for Implicit flow usage beyond this 90-day time period. If the query returns no results, applications have not used the Implicit flow within the last 90 days.