---
schema_version: "1"
id: eb1d9bf8f2cde3e02d70beeef6073a2d2983f3936e764ca5f50f8083c76c5e24
title: OAuth Module Reference
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/oauth-module/latest/oauth-module-reference.md
canonical_url: https://docs.mulesoft.com/oauth-module/latest/oauth-module-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: a91c4bd36701492380d64ad70860833454f0b49f7277645e57d0a60aa066c675
description: MuleSoft Documentation Site
release: "1.1"
latest: true
---
---
product: OAuth Module
version: 1.1
is-latest-version: true
---

# OAuth Module Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

OAuth Module v1.1

OAuth Module is an extension to hook OAuth2 to HTTP extension connectors.

## Configurations

---

### Config

Default configuration

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr></tbody></table>

## Operations

- [Invalidate Oauth Context](#invalidateOauthContext)

- [Retrieve Access Token](#retrieveAccessToken)

- [Retrieve Custom Token Response Param](#retrieveCustomTokenResponseParam)

- [Retrieve Expires In](#retrieveExpiresIn)

- [Retrieve Refresh Token](#retrieveRefreshToken)

- [Retrieve State](#retrieveState)

### Invalidate Oauth Context

`<oauth:invalidate-oauth-context>`

Clears the OAuth context for a token manager and a resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the credentials to invalidate..</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed only for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr></tbody></table>

### Retrieve Access Token

`<oauth:retrieve-access-token>`

Returns the access token of the token manager for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed only for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve Custom Token Response Param

`<oauth:retrieve-custom-token-response-param>`

Returns the value of the parameter that is extracted during the OAuth dance from the token manager
for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>A key to look in the elements that are extracted after the OAuth dance.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve Expires In

`<oauth:retrieve-expires-in>`

Returns the expiration of the OAuth context for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve Refresh Token

`<oauth:retrieve-refresh-token>`

Returns the refresh token of the OAuth context for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the refresh token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The mime type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve State

`<oauth:retrieve-state>`

Returns the state of the OAuth context for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

## Types

### Token Manager Config

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Object Store</strong></p></td><td><div><div><p>Object Store</p></div></div></td><td><div><div><p>An object store to store the OAuth context data.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Authorization Code Grant Type

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Local Callback Config</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Listener configuration to use instead of <code>localCallbackUrl</code>. Note that if using this configuration you must also provide a <code>localCallbackConfigPath</code> separately.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Callback Config Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Local path for the listener created according to <code>localCallbackConfig</code>, not required if you use <code>localCallbackUrl</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Callback Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>URL that enables Mule runtime engine (Mule) to automatically create an endpoint in the configured URL that stores the authentication code unless there is an endpoint already registered to manually extract the authorization code.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External Callback Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server uses the URL to provide the authentication code to the Mule server in order to retrieve the access token. Note that the URL must be the externally visible address of the callback, not the local address.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>State</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>State parameter for holding state between the authentication request and the callback done by the OAuth authorization server to the <code>redirectUrl</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Authorization Url Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Identifier to store the OAuth authentication attributes (accessToken, refreshToken, etc). This attribute is required only when applications access resources from more than one user in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Authorization Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>URL that enables Mule to automatically create an endpoint in the host server for the user to authenticate and grant access to the application for their account.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Authorization Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server URL to authorize the app for a certain user.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Custom Parameters</strong></p></td><td><div><div><p>Object</p></div></div></td><td><div><div><p>Custom parameters to send to the authorization request URL or the OAuth authorization sever.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Identifier to store the OAuth authentication attributes (accessToken, refreshToken, etc). This attribute is required only when applications access resources from more than one user in the OAuth authentication server.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Encode Client Credentials In Body</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If <code>true</code>, the client ID and client secret are sent in the request body. Otherwise, the client ID and client secret are sent as basic authentication.</p></div></div></td><td><div><div><p>true</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application identifier defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application secret defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Scopes</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Scope required by the application to execute. Scopes define permissions over resources.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager configuration to use for the grant type.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server URL to get access to the token. Mule calls this URL to get the access token, after receiving the authentication code from the OAuth server through the <code>redirectUrl</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Response Access Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the access token parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.access_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Refresh Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Response refresh token.</p></div></div></td><td><div><div><p><code>#[payload.refresh_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Expires In</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the expires in parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.expires_in]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Custom Parameter Extractors</strong></p></td><td><div><div><p>Array of <a href="#ParameterExtractor">Parameter Extractor</a></p></div></div></td><td><div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Refresh Token When</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Enables expressions to evaluate against the HTTP response of the API callback to determine if the request failed because it was done using an expired token. If the evaluation returns <code>true</code> (access token expired), Mule automatically triggers a refresh token flow and retries the API callback using a new access token. Default value evaluates if the response status code is <code>401</code> or <code>403</code>.</p></div></div></td><td><div><div><p><code>#[attributes.statusCode == 401 or attributes.statusCode == 403]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Tls Context</strong></p></td><td><div><div><p><a href="#Tls">TLS</a></p></div></div></td><td><div><div><p>A TLS configuration to receive incoming HTTP requests and do HTTP requests during the OAuth dance.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Parameter Extractor

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Param Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Parameter extractor name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Value for this type.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr></tbody></table>

### TLS

Configures TLS to provide secure communications for the Mule app.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Enabled Protocols</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Comma-separated list of protocols enabled for this context.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Enabled Cipher Suites</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Comma-separated list of cipher suites enabled for this context.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Trust Store</strong></p></td><td><div><div><p><a href="#TrustStore">Truststore</a></p></div></div></td><td><div><div><p>Configures the TLS truststore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Store</strong></p></td><td><div><div><p><a href="#KeyStore">Keystore</a></p></div></div></td><td><div><div><p>Configures the TLS keystore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Revocation Check</strong></p></td><td><div><div><ul><li><p><a href="#standard-revocation-check">Standard Revocation Check</a></p></li><li><p><a href="#custom-ocsp-responder">Custom OCSP Responder</a></p></li><li><p><a href="#crl-file">CRL File</a></p></li></ul></div></div></td><td><div><div><p>Revocation check configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Truststore

Configures the truststore for TLS.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to the truststore. Mule resolves the path relative to the current classpath and file system.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Password</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Password used to protect the truststore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Type of store.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Algorithm</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Encryption algorithm that the truststore uses.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Insecure</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If <code>true</code>, Mule stops performing certificate validations. Setting this attribute to <code>true</code> make connections vulnerable to attacks.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Keystore

Configures the keystore for the TLS protocol. The keystore you generate contains a private key and a
public certificate.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to the keystore. Mule resolves the path relative to the current classpath and file system.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Type of store.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Alias</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Alias of the key to use when the keystore contains multiple private keys. By default, Mule uses the first key in the file.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Password</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Password used to protect the private key.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Password</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Password used to protect the keystore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Algorithm</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Encryption algorithm that the keystore uses.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Standard Revocation Check

Configures standard revocation checks for TLS certificates.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Only End Entities</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Which elements to verify in the certificate chain:</p></div><div><ul><li><p><code>true</code><br>Verifies only the last element in the certificate chain.</p></li><li><p><code>false</code><br>Verifies all the elements in the certificate chain.</p></li></ul></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Prefer Crls</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>How to check certificate validity:</p></div><div><ul><li><p><code>true</code>+ Checks the Certification Revocation List (CRL) for certificate validity.</p></li><li><p><code>false</code>+</p></li></ul></div><div><p>Checks the Online Certificate Status Protocol (OCSP) for certificate validity.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>No Fallback</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Whether to use the secondary method to check certificate validity:</p></div><div><ul><li><p><code>true</code><br></p></li></ul></div><div><p>Uses the method not specified in the <strong>Prefer Crls</strong> field to check the certificate validity.</p></div><div><ul><li><p><code>false</code></p></li></ul></div><div><p>Does not use the method specified in the <strong>Prefer Crls</strong> field to check certificate validity.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Soft Fail</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>What to do if the revocation server can’t be reached or is busy:</p></div><div><ul><li><p><code>true</code></p></li></ul></div><div><p>Avoids verification failure.</p></div><div><ul><li><p><code>false</code></p></li></ul></div><div><p>Enables the verification to fail.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Custom OCSP Responder

Configures a custom OCSP responder for certification revocation checks.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>URL of the OCSP responder.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Cert Alias</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Alias of the signing certificate for the OCSP response. If specified, the alias must be configured in the truststore.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### CRL File

Specifies the location of the certification revocation list (CRL) file.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to the CRL file.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Client Credentials Grant Type

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Encode Client Credentials In Body</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If true, the client ID and client secret are sent in the request body. Otherwise, the client ID and client secret are sent as basic authentication.</p></div></div></td><td><div><div><p>false</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application identifier defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application secret defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Scopes</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Scope required by the application to execute. Scopes define permissions over resources.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager configuration to use for the grant type.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server URL to get access to the token. Mule calls this URL to get the access token, after receiving the authentication code from the OAuth server through the <code>redirectUrl</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Response Access Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the access token parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.access_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Refresh Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Response refresh token.</p></div></div></td><td><div><div><p><code>#[payload.refresh_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Expires In</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the expires in parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.expires_in]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Custom Parameter Extractors</strong></p></td><td><div><div><p>Array of <a href="#ParameterExtractor">Parameter Extractor</a></p></div></div></td><td><div><div><p>Custom parameter extractors configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Refresh Token When</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Enables expressions to evaluate against the HTTP response of the API callback to determine if the request failed because it was done using an expired token. If the evaluation returns <code>true</code> (access token expired), Mule automatically triggers a refresh token flow and retries the API callback using a new access token. Default value evaluates if the response status code is <code>401</code> or <code>403</code>.</p></div></div></td><td><div><div><p><code>#[attributes.statusCode == 401 or attributes.statusCode == 403]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>TLS Context</strong></p></td><td><div><div><p><a href="#Tls">TLS</a></p></div></div></td><td><div><div><p>A TLS configuration to receive incoming HTTP requests and do HTTP requests during the OAuth dance.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## See Also

- [Salesforce Help](https://help.salesforce.com)