---
schema_version: "1"
id: bc809ca99287d6e1600d7c88975349f0374a11bcb591b986141327fc20c1eda3
title: Mule Secure Token Service OAuth 2.0
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/4.3/mule-secure-token-service.md
canonical_url: https://docs.mulesoft.com/mule-runtime/4.3/mule-secure-token-service
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 3b00da1b97f648e55bd1e33254d10a81012975ee58bb6e1f40f42c0f623f9225
description: MuleSoft Documentation Site
release: "4.3"
latest: false
---
---
product: Mule Runtime
version: 4.3
keywords: security, oauth, authentication, oauth provider, token, private key, secret key, access key
---

# Mule Secure Token Service OAuth 2.0

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The Mule runtime engine supports the OAuth 2.0 protocol. The way to configure OAuth 2.0
authorization differs, depending on the OAuth role and your objective:

- Configure authentication in your client Mule app when sending requests to a service that requires
  authentication, such as the Github OAuth2 server. Use the
  [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/oauth-module-reference) for the OAuth2 configuration.

- Use the
  [Mule OAuth2 Provider Connector](https://docs.mulesoft.com/oauth2-provider-module/latest/oauth2-provider-module-reference)
  to create a Mule application that grants and validates the tokens needed to access a protected
  resource.

To protect your API or app from receiving unauthorized requests, use an API Manager policy, such as
the `OAuth 2.0 Access Token Enforcement Using External Provider` policy. To expose a web service
protected by OAuth 2.0 security, see the
[API Manager documentation](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page).

## See Also

- [OAuth Authorization Grant Types](https://docs.mulesoft.com/mule-runtime/4.3/authorization-grant-types)