---
schema_version: "1"
id: 4cada7350904e75c8b3c718d431292e46aa4de86671952579c8f099bc590cb71
title: Credential Injection OAuth 2.0 Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-outbound-oauth.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-outbound-oauth
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2d4532efc81084cae3b323a39a66956b342472ff1fae1ede18a0a7fdf3ad23f9
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: basic authentication, api gateway, flex gateway, gateway, policy
---

# Credential Injection OAuth 2.0 Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Credential Injection OAuth 2.0</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Injects an OAuth 2.0 authorization header into outgoing requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.9.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/outbound-oauth-release-notes">Credential Injection OAuth 2.0</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. Error codes are returned from the upstream service.</p></td></tr></tbody></table>

## Summary

The Credential Injection OAuth 2.0 policy injects an `Authorization` token from an OAuth 2.0 service
into a request as a header. You can use any third-party OAuth 2.0 Identify Provider (IdP), such as
Okta, AWS, Azure, or Google Cloud Platform. The policy allows for tokens based on the OAuth 2.0
Authorization Framework to be injected into requests without having to register an external IdP
server in Anypoint Platform.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: credential-injection-oauth2-flex config: oauthService: <string> // REQUIRED
grantType: <string> // REQUIRED, supported values: clientCredentials or password credentialLocation:
<string> // REQUIRED, supported values: body or header clientId: <string> // REQUIRED for
clientCredentials grant type clientSecret: <string> // REQUIRED for clientCredentials grant type
username: <string> // REQUIRED for password grant type password: <string> // REQUIRED for password
grant type scope: - <string> // OPTIONAL overwrite: <boolean> // REQUIRED tokenFetchTimeout:
<number> // REQUIRED allowRequestWithoutCredential: <boolean> // REQUIRED tokenRequestBodyFormat:
<string> // REQUIRED, supported values: json or urlEncoded upstreamTokenHeaderName: <string> //
OPTIONAL upstreamTokenPrefixName: <string> // OPTIONAL cachingTtl: <number> // REQUIRED
customRequestHeaders: // OPTIONAL - name: <string> value: <string> customRequestBodyParameters: //
OPTIONAL - name: <string> value: <string> // string or DataWeave expression

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>oauthService</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code><a href="https://oauth-server/tokens">https://oauth-server/tokens</a></code></p></div></div></td><td><div><div><p>URL of the OAuth 2.0 service.</p></div></div></td></tr><tr><td><div><div><p><code>grantType</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>clientCredentials</code></p></div></div></td><td><div><div><p>OAuth2 grant type specifying the method used to obtain access tokens from the authorization server. Supported values: <code>clientCredentials</code> or <code>password</code>.</p></div></div></td></tr><tr><td><div><div><p><code>credentialLocation</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>body</code></p></div></div></td><td><div><div><p>Location of the Client ID and Client Secret in the OAuth2 token request. Supported values: <code>body</code> or <code>header</code>.</p></div></div></td></tr><tr><td><div><div><p><code>clientId</code></p></div></div></td><td><div><div><p>Required for <code>clientCredentials</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Client ID.</p></div></div></td></tr><tr><td><div><div><p><code>clientSecret</code></p></div></div></td><td><div><div><p>Required for <code>clientCredentials</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Client Secret.</p></div></div></td></tr><tr><td><div><div><p><code>username</code></p></div></div></td><td><div><div><p>Required for <code>password</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Username for password grant type.</p></div></div></td></tr><tr><td><div><div><p><code>password</code></p></div></div></td><td><div><div><p>Required for <code>password</code> grant type</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Password for password grant type.</p></div></div></td></tr><tr><td><div><div><p><code>scope</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Scopes to include in the token.</p></div></div></td></tr><tr><td><div><div><p><code>overwrite</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>When enabled, the policy overwrites the <code>Authorization</code> header with a new authorization token if the header is present.</p></div></div></td></tr><tr><td><div><div><p><code>tokenFetchTimeout</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>10</p></div></div></td><td><div><div><p>Time in seconds to wait for the service to return the token.</p></div></div></td></tr><tr><td><div><div><p><code>allowRequestWithoutCredential</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>When enabled, if the policy can’t retrieve the token, Omni Gateway still sends the request.</p></div></div></td></tr><tr><td><div><div><p><code>tokenRequestBodyFormat</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>urlEncoded</code></p></div></div></td><td><div><div><p>The format of the token request body. Valid values: <code>json</code> or <code>urlEncoded</code>.</p></div></div></td></tr><tr><td><div><div><p><code>upstreamTokenHeaderName</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom header instead of <code>Authorization</code>.</p></div></div></td></tr><tr><td><div><div><p><code>upstreamTokenPrefixName</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Use a custom token prefix instead of <code>Bearer</code>.</p></div></div></td></tr><tr><td><div><div><p><code>cachingTtl</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>0</p></div></div></td><td><div><div><p>Time to live for cached tokens in seconds. If 0, the policy uses the full <code>expires_in</code> value from OAuth response. If greater than 0, the policy uses the minimum of the <code>cachingTtl</code> value and <code>expires_in</code> divided by 2.</p></div></div></td></tr><tr><td><div><div><p><code>customRequestHeaders</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A list of custom headers to add to the token request. Each header must have a <code>name</code> and <code>value</code> property.</p></div></div></td></tr><tr><td><div><div><p><code>customRequestBodyParameters</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>A list of custom parameters to add to the token request body, such as <code>audience</code>. Each parameter must have a <code>name</code> and <code>value</code> property. The <code>value</code> can be a static string or a DataWeave expression.</p></div></div></td></tr></tbody></table>

#### Client Credentials Configuration Example

\- policyRef: name: credential-injection-oauth2-flex config: oauthService:
<https://oauth-server/tokens> grantType: clientCredentials credentialLocation: body clientId: id
clientSecret: secret scope: - user overwrite: true tokenFetchTimeout: 20
allowRequestWithoutCredential: true tokenRequestBodyFormat: urlEncoded cachingTtl: 0

#### Password Configuration Example

\- policyRef: name: credential-injection-oauth2-flex config: oauthService:
<https://oauth-server/tokens> grantType: password credentialLocation: body clientId: id
clientSecret: secret username: myuser password: mypassword scope: - user - read overwrite: true
tokenFetchTimeout: 20 allowRequestWithoutCredential: true tokenRequestBodyFormat: urlEncoded
cachingTtl: 0

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Required?</th></tr></thead><tbody><tr><td><p>OAuth 2.0 service URL</p></td><td><p>URL of the OAuth 2.0 service.</p></td><td><p>Required</p></td></tr><tr><td><p>Grant Type</p></td><td><p>OAuth2 grant type specifying the method used to obtain access tokens from the authorization server. Valid values: Client Credentials or Password.</p></td><td><p>Required</p></td></tr><tr><td><p>Credential location</p></td><td><p>Location of the Client ID and Client Secret in the OAuth2 token request.</p></td><td><p>Required</p></td></tr><tr><td><p>Client ID</p></td><td><p>Client ID.</p></td><td><p>Required for Client Credentials grant type</p></td></tr><tr><td><p>Client secret</p></td><td><p>Client Secret.</p></td><td><p>Required for Client Credentials grant type</p></td></tr><tr><td><p>Username</p></td><td><p>Username for password grant type.</p></td><td><p>Required for Password grant type</p></td></tr><tr><td><p>Password</p></td><td><p>Password for password grant type.</p></td><td><p>Required for Password grant type</p></td></tr><tr><td><p>Scope</p></td><td><p>List of scopes to use for OAuth2 request.</p></td><td><p>Optional</p></td></tr><tr><td><p>Overwrite header</p></td><td><p>When enabled, the policy overwrites the <code>Authorization</code> header with a new authorization token if the header is present.</p></td><td><p>Required</p></td></tr><tr><td><p>Token fetch timeout</p></td><td><p>Time in seconds to wait for the service to return the token.</p></td><td><p>Required</p></td></tr><tr><td><p>Allow request without credential</p></td><td><p>When enabled, if the policy can’t retrieve the token, Omni Gateway still sends the request.</p></td><td><p>Required</p></td></tr><tr><td><p>Token Request Body Format</p></td><td><p>The format of the token request body. Valid values: URL Encoded or JSON.</p></td><td><p>Required</p></td></tr><tr><td><p>Upstream Custom header</p></td><td><p>Use a custom header instead of Authorization.</p></td><td><p>Optional</p></td></tr><tr><td><p>Upstream Custom Token Prefix</p></td><td><p>Use a custom token prefix instead of Bearer.</p></td><td><p>Optional</p></td></tr><tr><td><p>Caching TTL (seconds)</p></td><td><p>Time to live for cached tokens in seconds. If 0, the policy uses the full <code>expires_in</code> value from OAuth response. If greater than 0, the policy uses the minimum of the Caching TTL value and <code>expires_in</code> divided by 2.</p></td><td><p>Required</p></td></tr><tr><td><p>Custom Request Headers</p></td><td><p>A list of custom headers to add to the token request. Each header must have a name and value property.</p></td><td><p>Optional</p></td></tr><tr><td><p>Custom Request Body Parameters</p></td><td><p>A list of custom parameters to add to the token request body, such as <code>audience</code>. Each parameter must have a name and value property. The value can be a static string or a DataWeave expression.</p></td><td><p>Optional</p></td></tr></tbody></table>