---
schema_version: "1"
id: 8f34842e7859dde90bdac016ff46d27ae35eb40bc92538f0e062b64713bc5c00
title: Mule Secure Token Service OAuth 2.0
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/4.12/mule-secure-token-service.md
canonical_url: https://docs.mulesoft.com/mule-runtime/4.12/mule-secure-token-service
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 0372094f0b5228f77cd1ecfb7901daf2395f58e40461eca2e6e8a945a614bb8e
description: MuleSoft Documentation Site
release: "4.12"
latest: false
---
---
product: Mule Runtime
version: 4.12
keywords: security, oauth, authentication, oauth provider, token, private key, secret key, access key
---

# Mule Secure Token Service OAuth 2.0

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The Mule runtime engine supports the OAuth 2.0 protocol. The way to configure OAuth 2.0
authorization differs, depending on the OAuth role and your objective:

- Configure authentication in your client Mule app when sending requests to a service that requires
  authentication, such as the Github OAuth2 server. Use the
  [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/oauth-module-reference) for the OAuth2 configuration.

- Use the
  [Mule OAuth2 Provider Connector](https://docs.mulesoft.com/oauth2-provider-module/latest/oauth2-provider-module-reference)
  to create a Mule application that grants and validates the tokens needed to access a protected
  resource.

To protect your API or app from receiving unauthorized requests, use an API Manager policy, such as
the `OAuth 2.0 Access Token Enforcement Using External Provider` policy. To expose a web service
protected by OAuth 2.0 security, see the
[API Manager documentation](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page).

## See Also

- [OAuth Authorization Grant Types](https://docs.mulesoft.com/mule-runtime/4.12/authorization-grant-types)