---
schema_version: "1"
id: 094a0af05444fd1d601ea082c8ada93e54eac43cd88742f1719095e5aee5f551
title: Mule Secure Token Service OAuth 2.0
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/latest/mule-secure-token-service.md
canonical_url: https://docs.mulesoft.com/mule-runtime/latest/mule-secure-token-service
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 537ed3704f4f580e0c214df7005e3acc6eacf0cc7de5154e0e9f6d440de99d93
description: MuleSoft Documentation Site
release: "4.13"
latest: true
---
---
product: Mule Runtime
version: 4.13
is-latest-version: true
keywords: security, oauth, authentication, oauth provider, token, private key, secret key, access key
---

# Mule Secure Token Service OAuth 2.0

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The Mule runtime engine supports the OAuth 2.0 protocol. The way to configure OAuth 2.0
authorization differs, depending on the OAuth role and your objective:

- Configure authentication in your client Mule app when sending requests to a service that requires
  authentication, such as the Github OAuth2 server. Use the
  [OAuth Module](https://docs.mulesoft.com/oauth-module/latest/oauth-module-reference) for the OAuth2 configuration.

- Use the
  [Mule OAuth2 Provider Connector](https://docs.mulesoft.com/oauth2-provider-module/latest/oauth2-provider-module-reference)
  to create a Mule application that grants and validates the tokens needed to access a protected
  resource.

To protect your API or app from receiving unauthorized requests, use an API Manager policy, such as
the `OAuth 2.0 Access Token Enforcement Using External Provider` policy. To expose a web service
protected by OAuth 2.0 security, see the
[API Manager documentation](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page).

## See Also

- [OAuth Authorization Grant Types](https://docs.mulesoft.com/mule-runtime/latest/authorization-grant-types)