---
schema_version: "1"
id: 9b2788205dee60d243d3b9dd785cd9592594ac509ec9b1e87d695966d7789b76
title: Credential Injection OAuth 2.0 Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.9/policies-outbound-oauth.md
canonical_url: https://docs.mulesoft.com/gateway/1.9/policies-outbound-oauth
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 212d85695b691f06713caaf105f46f48e1ba708696ddbb80995d1137adeb2ff3
description: MuleSoft Documentation Site
release: "1.9"
latest: false
---
---
product: Omni Gateway
version: 1.9
keywords: basic authentication, api gateway, flex gateway, gateway, policy
---

# Credential Injection OAuth 2.0 Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Credential Injection OAuth 2.0</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Injects an OAuth 2.0 authorization header into outgoing requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.9.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. Error codes are returned from the upstream service.</p></td></tr></tbody></table>

## Summary

The Credential Injection OAuth 2.0 policy injects an `Authorization` token from an OAuth 2.0 service
into a request as a header. You can use any third-party OAuth 2.0 Identify Provider (IdP), such as
Okta, AWS, Azure, or Google Cloud Platform. The policy allows for tokens based on the OAuth 2.0
Authorization Framework to be injected into requests without having to register an external IdP
server in Anypoint Platform.

## Configuring Policy Parameters

### Flex Gateway Local Mode

In Local Mode, you apply the policy to your API via declarative configuration files. Refer to the
following policy definition and table of parameters:

\- policyRef: name: credential-injection-oauth2-flex config: oauthService: <string> // REQUIRED
clientId: <string> // REQUIRED clientSecret: <string> // REQUIRED scope: - <string> // OPTIONAL
overwrite: <boolean> // OPTIONAL tokenFetchTimeout: <number> // OPTIONAL
allowRequestWithoutCredential: <boolean> // OPTIONAL

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>oauthService</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code><a href="https://oauth-server/tokens">https://oauth-server/tokens</a></code></p></div></div></td><td><div><div><p>URL of the OAuth 2.0 service.</p></div></div></td></tr><tr><td><div><div><p><code>clientId</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Client ID.</p></div></div></td></tr><tr><td><div><div><p><code>clientSecret</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Client Secret.</p></div></div></td></tr><tr><td><div><div><p><code>scope</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Scopes to include in the token.</p></div></div></td></tr><tr><td><div><div><p><code>overwrite</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>When enabled, the policy overwrites the <code>Authorization</code> header with a new authorization token if the header is present.</p></div></div></td></tr><tr><td><div><div><p><code>tokenFetchTimeout</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>10</p></div></div></td><td><div><div><p>Time in seconds to wait for the service to return the token.</p></div></div></td></tr><tr><td><div><div><p><code>allowRequestWithoutCredential</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: credential-injection-oauth2-flex config: oauthService:
<https://oauth-server/tokens> clientId: id clientSecret: secret scope: - user tokenFetchTimeout: 20
allowRequestWithoutCredential: true

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy to your API instance from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Required?</th></tr></thead><tbody><tr><td><p>OAuth 2.0 service URL</p></td><td><p>URL of the OAuth 2.0 service.</p></td><td><p>Required</p></td></tr><tr><td><p>Client ID</p></td><td><p>Client ID.</p></td><td><p>Required</p></td></tr><tr><td><p>Client secret</p></td><td><p>Client Secret.</p></td><td><p>Required</p></td></tr><tr><td><p>Scope</p></td><td><p>Scopes to include in the token.</p></td><td><p>Optional</p></td></tr><tr><td><p>Overwrite header</p></td><td><p>When enabled, the policy overwrites the <code>Authorization</code> header with a new authorization token if the header is present.</p></td><td><p>Required</p></td></tr><tr><td><p>Token fetch timeout</p></td><td><p>Time in seconds to wait for the service to return the token.</p></td><td><p>Required</p></td></tr><tr><td><p>Allow request without credential</p></td><td><p>When enabled, if the policy can’t retrieve the token, Flex Gateway still sends the request.</p></td><td><p>Required</p></td></tr></tbody></table>