---
schema_version: "1"
id: 459b0e66472f1ccc1df008029c619ddf5065c2e1338a041143a24f67319fbc99
title: Credential Injection OAuth 2.0 Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-outbound-oauth.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-outbound-oauth
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 92b7909187aff84b6df4016846da33d4f529d4e1190521513c45acbf12a7738e
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
keywords: basic authentication, api gateway, flex gateway, gateway, policy
---

# Credential Injection OAuth 2.0 Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Credential Injection OAuth 2.0</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Injects an OAuth 2.0 authorization header into outgoing requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.9.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. Error codes are returned from the upstream service.</p></td></tr></tbody></table>

## Summary

The Credential Injection OAuth 2.0 policy injects an `Authorization` token from an OAuth 2.0 service
into a request as a header. You can use any third-party OAuth 2.0 Identify Provider (IdP), such as
Okta, AWS, Azure, or Google Cloud Platform. The policy allows for tokens based on the OAuth 2.0
Authorization Framework to be injected into requests without having to register an external IdP
server in Anypoint Platform.

## Configuring Policy Parameters

### Flex Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: credential-injection-oauth2-flex config: oauthService: <string> // REQUIRED
grantType: <string> // REQUIRED, supported values: clientCredentials or password credentialLocation:
<string> // REQUIRED, supported values: body or header clientId: <string> // REQUIRED for
clientCredentials grant type clientSecret: <string> // REQUIRED for clientCredentials grant type
username: <string> // REQUIRED for password grant type password: <string> // REQUIRED for password
grant type scope: - <string> // OPTIONAL overwrite: <boolean> // REQUIRED tokenFetchTimeout:
<number> // REQUIRED allowRequestWithoutCredential: <boolean> // REQUIRED tokenRequestBodyFormat:
<string> // REQUIRED, supported values: json or urlEncoded upstreamTokenHeaderName: <string> //
OPTIONAL upstreamTokenPrefixName: <string> // OPTIONAL cachingTtl: <number> // REQUIRED
customRequestHeaders: // OPTIONAL - name: <string> value: <string>

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>oauthService</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code><a href="https://oauth-server/tokens">https://oauth-server/tokens</a></code></p></div></div></td><td><div><div><p>URL of the OAuth 2.0 service.</p></div></div></td></tr><tr><td><div><div><p><code>grantType</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>clientCredentials</code></p></div></div></td><td><div><div><p>OAuth2 grant type specifying the method used to obtain access tokens from the authorization server. Supported values: <code>clientCredentials</code> or <code>password</code>.</p></div></div></td></tr><tr><td><div><div><p><code>credentialLocation</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>body</code></p></div></div></td><td><div><div><p>Location of the Client ID and Client Secret in the OAuth2 token request. Supported values: <code>body</code> or <code>header</code>.</p></div></div></td></tr><tr><td><div><div><p><code>clientId</code></p></div></div></td><td><div><div><p>Required for <code>clientCredentials</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Client ID.</p></div></div></td></tr><tr><td><div><div><p><code>clientSecret</code></p></div></div></td><td><div><div><p>Required for <code>clientCredentials</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Client Secret.</p></div></div></td></tr><tr><td><div><div><p><code>username</code></p></div></div></td><td><div><div><p>Required for <code>password</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Username for password grant type.</p></div></div></td></tr><tr><td><div><div><p><code>password</code></p></div></div></td><td><div><div><p>Required for <code>password</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Password for password grant type.</p></div></div></td></tr><tr><td><div><div><p><code>scope</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Scopes to include in the token.</p></div></div></td></tr><tr><td><div><div><p><code>overwrite</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>When enabled, the policy overwrites the <code>Authorization</code> header with a new authorization token if the header is present.</p></div></div></td></tr><tr><td><div><div><p><code>tokenFetchTimeout</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>10</p></div></div></td><td><div><div><p>Time in seconds to wait for the service to return the token.</p></div></div></td></tr><tr><td><div><div><p><code>allowRequestWithoutCredential</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.</p></div></div></td></tr><tr><td><div><div><p><code>tokenRequestBodyFormat</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>urlEncoded</code></p></div></div></td><td><div><div><p>The format of the token request body. Valid values: <code>json</code> or <code>urlEncoded</code>.</p></div></div></td></tr><tr><td><div><div><p><code>upstreamTokenHeaderName</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom header instead of <code>Authorization</code>.</p></div></div></td></tr><tr><td><div><div><p><code>upstreamTokenPrefixName</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom token prefix instead of <code>Bearer</code>.</p></div></div></td></tr><tr><td><div><div><p><code>cachingTtl</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>0</p></div></div></td><td><div><div><p>Time to live for cached tokens in seconds. If 0, the policy uses the full <code>expires_in</code> value from OAuth response. If greater than 0, the policy uses the minimum of the <code>cachingTtl</code> value and <code>expires_in</code> divided by 2.</p></div></div></td></tr><tr><td><div><div><p><code>customRequestHeaders</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A list of custom headers to add to the token request. Each header must have a <code>name</code> and <code>value</code> property.</p></div></div></td></tr></tbody></table>

#### Client Credentials Configuration Example

\- policyRef: name: credential-injection-oauth2-flex config: oauthService:
<https://oauth-server/tokens> grantType: clientCredentials credentialLocation: body clientId: id
clientSecret: secret scope: - user overwrite: true tokenFetchTimeout: 20
allowRequestWithoutCredential: true tokenRequestBodyFormat: urlEncoded cachingTtl: 0

#### Password Configuration Example

\- policyRef: name: credential-injection-oauth2-flex config: oauthService:
<https://oauth-server/tokens> grantType: password credentialLocation: body clientId: id
clientSecret: secret username: myuser password: mypassword scope: - user - read overwrite: true
tokenFetchTimeout: 20 allowRequestWithoutCredential: true tokenRequestBodyFormat: urlEncoded
cachingTtl: 0

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Required?</th></tr></thead><tbody><tr><td><p>OAuth 2.0 service URL</p></td><td><p>URL of the OAuth 2.0 service.</p></td><td><p>Required</p></td></tr><tr><td><p>Grant Type</p></td><td><p>OAuth2 grant type specifying the method used to obtain access tokens from the authorization server. Valid values: Client Credentials or Password.</p></td><td><p>Required</p></td></tr><tr><td><p>Credential location</p></td><td><p>Location of the Client ID and Client Secret in the OAuth2 token request.</p></td><td><p>Required</p></td></tr><tr><td><p>Client ID</p></td><td><p>Client ID.</p></td><td><p>Required for Client Credentials grant type</p></td></tr><tr><td><p>Client secret</p></td><td><p>Client Secret.</p></td><td><p>Required for Client Credentials grant type</p></td></tr><tr><td><p>Username</p></td><td><p>Username for password grant type.</p></td><td><p>Required for Password grant type</p></td></tr><tr><td><p>Password</p></td><td><p>Password for password grant type.</p></td><td><p>Required for Password grant type</p></td></tr><tr><td><p>Scope</p></td><td><p>List of scopes to use for OAuth2 request.</p></td><td><p>Optional</p></td></tr><tr><td><p>Overwrite header</p></td><td><p>When enabled, the policy overwrites the <code>Authorization</code> header with a new authorization token if the header is present.</p></td><td><p>Required</p></td></tr><tr><td><p>Token fetch timeout</p></td><td><p>Time in seconds to wait for the service to return the token.</p></td><td><p>Required</p></td></tr><tr><td><p>Allow request without credential</p></td><td><p>When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.</p></td><td><p>Required</p></td></tr><tr><td><p>Token Request Body Format</p></td><td><p>The format of the token request body. Valid values: URL Encoded or JSON.</p></td><td><p>Required</p></td></tr><tr><td><p>Upstream Custom header</p></td><td><p>Use a custom header instead of Authorization.</p></td><td><p>Optional</p></td></tr><tr><td><p>Upstream Custom Token Prefix</p></td><td><p>Use a custom token prefix instead of Bearer.</p></td><td><p>Optional</p></td></tr><tr><td><p>Caching TTL (seconds)</p></td><td><p>Time to live for cached tokens in seconds. If 0, the policy uses the full <code>expires_in</code> value from OAuth response. If greater than 0, the policy uses the minimum of the Caching TTL value and <code>expires_in</code> divided by 2.</p></td><td><p>Required</p></td></tr><tr><td><p>Custom Request Headers</p></td><td><p>A list of custom headers to add to the token request. Each header must have a name and value property.</p></td><td><p>Optional</p></td></tr></tbody></table>