Okta IP Ranges
Okta publishes its addresses in one JSON file hosted on Amazon S3, keyed not by product but by cell - the separate infrastructure stack an Okta tenant lives in. On 16 October 2026 it named 31 cells. Counted across them the file has 5,225 entries, but cells share addresses, and the distinct total is 2,214 IPv4 prefixes covering 2,595 addresses. There is no IPv6. Okta runs mostly on AWS: of 120 prefixes sampled at random, all 120 were announced by Amazon, with a handful of Google Cloud hosts elsewhere in the file.
- Provider
- Okta
- Hosting network
- AS16509 (Amazon Web Services, host)
- Category
- Tech
- Headquarters
- San Francisco, CA, USA
- Published IPv4 prefixes
- 2214
- Registry
- Self-published list
Known IP ranges
Okta does not announce these addresses under an ASN of its own. They are the prefixes it publishes in https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, as fetched on 2026-10-16; the space itself is routed by AS16509 (Amazon Web Services). The list decides whether an address belongs to Okta - WHOIS for any of them returns the host network.
18.209.113.128/26
52.14.242.0/28
3.15.36.192/29
3.235.123.128/29
18.188.239.208/29
34.223.89.192/29
34.223.89.224/29
34.223.95.136/29
34.223.206.0/29
34.236.241.32/29
What does an Okta IP mean in a privacy test?
An Okta address in your logs is Okta's service reaching you: an inline or event hook, a SCIM call to provision users, a request to your directory agent. It is not a person signing in - those come from the person's own address - and it is not a VPN exit, so it says nothing about leaks.
Cells, and why the list is keyed by them
The file lives at s3.amazonaws.com/okta-ip-ranges/ip_ranges.json. Its top-level keys are cell names: us_cell_1 to us_cell_22 with gaps in the numbering, emea_cell_1 and 2, apac_cell_1 and 2, ca_cell_1, in_cell_1, three preview_cells for Okta's preview environment, and a set of pam cells for Okta Privileged Access. Each holds an ip_ranges array.
The cells differ enormously in size. us_cell_6 lists 503 entries and us_cell_1 to 4 481 each; us_cell_17 lists one. Nearly every entry is a single host: 4,983 of the 5,225 are /32s, and the widest are five /26s. An allowlist needs only the cell its own tenant runs in, which is a fraction of the file.
Why the whole file is the wrong allowlist
Admitting every address in the file admits every cell's infrastructure, including the preview environment, for a tenant that uses one. It also admits cloud space that Okta rents rather than owns: of 120 prefixes sampled on 16 October 2026, 104 were announced by AS16509 and 16 by AS14618, Amazon's networks, and a check of every 34.x and 35.x entry found 15 on Google Cloud's AS396982, such as 34.142.240.119. WHOIS names the cloud, not Okta.
For hooks, an address check is a second line rather than the first. Okta event and inline hooks send an authorization header that you configure, and checking it is what identifies Okta; the cell list narrows the source on top of that.
Related tools
Frequently asked questions
What IP ranges does Okta use?
The ranges in s3.amazonaws.com/okta-ip-ranges/ip_ranges.json, grouped by cell. On 16 October 2026: 31 cells, 2,214 distinct IPv4 prefixes, 2,595 addresses, no IPv6. Almost all are single /32 hosts, mostly on AWS.
Why does an Okta IP appear in my logs or a privacy test?
An Okta address in your logs is Okta's service reaching you: an inline or event hook, a SCIM call to provision users, a request to your directory agent. It is not a person signing in - those come from the person's own address - and it is not a VPN exit, so it says nothing about leaks.
What is an Okta cell?
A separate deployment of Okta's service that a group of tenants runs on. The published file is keyed by cell - us_cell_1, emea_cell_1, apac_cell_1 and so on - and a tenant's traffic comes from its own cell's addresses.
Why does the Okta file have 5,225 entries but 2,214 prefixes?
Because cells share infrastructure. The same address appears under several cells, so counting every entry counts it more than once. After removing duplicates and merging overlaps the file covers 2,595 addresses.
Why does WHOIS say Amazon for an Okta IP?
Okta runs mostly on AWS. All 120 prefixes sampled at random from the file were announced by Amazon's AS16509 or AS14618, so the registry record names Amazon, not Okta. A few entries, such as 34.142.240.119, are on Google Cloud.