Implement CIBA (Client-Initiated Backchannel Authentication) with Okta for call-center and out-of-band authentication

Steps

1. Create an Okta application with grant_type urn:openid:params:grant-type:ciba enabled and configure it with the client_notification_endpoint (for the ping mode) or use poll mode
2. Configure the Custom Authenticator that the CIBA push notification will target; in Okta, this uses the Okta Devices SDK to deliver out-of-band push to the user's enrolled device
3. From the consumption device (e.g. call center agent's app), POST to the Okta backchannel authentication endpoint with login_hint (user identifier), scope, and binding_message (a short code displayed to both the agent and user for correlation)
4. The AS returns auth_req_id, expires_in, and interval; use these to poll the token endpoint with grant_type urn:openid:params:grant-type:ciba and the auth_req_id
5. When the user approves on their device, the token endpoint returns id_token, access_token, and optionally refresh_token; when pending, it returns authorization_pending and you should continue polling
6. For Rich Authorization Requests (RAR) integration, include authorization_details in the CIBA request to send transaction details to the user's device for review before approval