---
schema_version: "1"
id: 504406df4f20db0f359da0d568b254eeb7cb5bf7831526f32b5c01843306f96b
title: Mule Secure Token Service OAuth 2.0
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/4.9/mule-secure-token-service.md
canonical_url: https://docs.mulesoft.com/mule-runtime/4.9/mule-secure-token-service
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2f1b5403f1a217373adf23d4aa98f7743e16cc3ba0cebe4e06673eb1dc2a8f74
description: MuleSoft Documentation Site
release: "4.9"
latest: false
---
---
product: Mule Runtime
version: 4.9
keywords: security, oauth, authentication, oauth provider, token, private key, secret key, access key
---

# Mule Secure Token Service OAuth 2.0

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The Mule runtime engine supports the OAuth 2.0 protocol. The way to configure OAuth 2.0
authorization differs, depending on the OAuth role and your objective:

- Configure authentication in your client Mule app when sending requests to a service that requires
  authentication, such as the Github OAuth2 server. Use the
  [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/oauth-module-reference) for the OAuth2 configuration.

- Use the
  [Mule OAuth2 Provider Connector](https://docs.mulesoft.com/oauth2-provider-module/latest/oauth2-provider-module-reference)
  to create a Mule application that grants and validates the tokens needed to access a protected
  resource.

To protect your API or app from receiving unauthorized requests, use an API Manager policy, such as
the `OAuth 2.0 Access Token Enforcement Using External Provider` policy. To expose a web service
protected by OAuth 2.0 security, see the
[API Manager documentation](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page).

## See Also

- [OAuth Authorization Grant Types](https://docs.mulesoft.com/mule-runtime/4.9/authorization-grant-types)