# mulesoft OAuth Module - Full Documentation

<!-- document id=3a89a03d5ac356e5b7195999a6aa566bf1832f3128e4954a0b6e317bfe98c121 url=/mulesoft/current/en-us/oauth-module/latest/index.md -->

---
product: OAuth Module
version: 1.1
is-latest-version: true
---

# OAuth Module

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

OAuth Module v1.1

OAuth Module is an extension to hook OAuth2 to HTTP extension connectors.

## Before You Begin

To use this module, you must be familiar with:

- Anypoint Connectors

- Mule runtime engine (Mule)

- Elements and global elements in a Mule flow

- Creating a Mule app using Anypoint Studio or Anypoint Code Builder

## Using Exchange Templates and Examples

[Anypoint Exchange](https://www.mulesoft.com/exchange/) provides templates that you can use as
starting points for your apps and examples that illustrate a complete solution.

- [OAuth Module in Anypoint Exchange](https://www.mulesoft.com/exchange/org.mule.modules/mule-oauth-module/)

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=eb1d9bf8f2cde3e02d70beeef6073a2d2983f3936e764ca5f50f8083c76c5e24 url=/mulesoft/current/en-us/oauth-module/latest/oauth-module-reference.md -->

---
product: OAuth Module
version: 1.1
is-latest-version: true
---

# OAuth Module Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

OAuth Module v1.1

OAuth Module is an extension to hook OAuth2 to HTTP extension connectors.

## Configurations

---

### Config

Default configuration

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr></tbody></table>

## Operations

- [Invalidate Oauth Context](#invalidateOauthContext)

- [Retrieve Access Token](#retrieveAccessToken)

- [Retrieve Custom Token Response Param](#retrieveCustomTokenResponseParam)

- [Retrieve Expires In](#retrieveExpiresIn)

- [Retrieve Refresh Token](#retrieveRefreshToken)

- [Retrieve State](#retrieveState)

### Invalidate Oauth Context

`<oauth:invalidate-oauth-context>`

Clears the OAuth context for a token manager and a resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the credentials to invalidate..</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed only for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr></tbody></table>

### Retrieve Access Token

`<oauth:retrieve-access-token>`

Returns the access token of the token manager for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed only for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve Custom Token Response Param

`<oauth:retrieve-custom-token-response-param>`

Returns the value of the parameter that is extracted during the OAuth dance from the token manager
for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>A key to look in the elements that are extracted after the OAuth dance.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve Expires In

`<oauth:retrieve-expires-in>`

Returns the expiration of the OAuth context for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve Refresh Token

`<oauth:retrieve-refresh-token>`

Returns the refresh token of the OAuth context for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the refresh token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The mime type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

### Retrieve State

`<oauth:retrieve-state>`

Returns the state of the OAuth context for the parametrized resource owner ID.

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager that holds the access token.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The resource owner ID to invalidate. This attribute is allowed for authorization code grant type.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Output Mime Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The MIME type of the payload that this operation outputs.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Variable</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name of the variable that stores the operation’s output.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Target Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression that evaluates the operation’s output. The expression outcome is stored in the <strong>Target Variable</strong>.</p></div></div></td><td><div><div><p><code>#[payload]</code></p></div></div></td><td><div></div></td></tr></tbody></table>

#### Output

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Type</p></td><td><p>String</p></td></tr></tbody></table>

## Types

### Token Manager Config

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Object Store</strong></p></td><td><div><div><p>Object Store</p></div></div></td><td><div><div><p>An object store to store the OAuth context data.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Authorization Code Grant Type

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Local Callback Config</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Listener configuration to use instead of <code>localCallbackUrl</code>. Note that if using this configuration you must also provide a <code>localCallbackConfigPath</code> separately.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Callback Config Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Local path for the listener created according to <code>localCallbackConfig</code>, not required if you use <code>localCallbackUrl</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Callback Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>URL that enables Mule runtime engine (Mule) to automatically create an endpoint in the configured URL that stores the authentication code unless there is an endpoint already registered to manually extract the authorization code.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External Callback Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server uses the URL to provide the authentication code to the Mule server in order to retrieve the access token. Note that the URL must be the externally visible address of the callback, not the local address.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>State</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>State parameter for holding state between the authentication request and the callback done by the OAuth authorization server to the <code>redirectUrl</code>.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Authorization Url Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Identifier to store the OAuth authentication attributes (accessToken, refreshToken, etc). This attribute is required only when applications access resources from more than one user in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Local Authorization Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>URL that enables Mule to automatically create an endpoint in the host server for the user to authenticate and grant access to the application for their account.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Authorization Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server URL to authorize the app for a certain user.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Custom Parameters</strong></p></td><td><div><div><p>Object</p></div></div></td><td><div><div><p>Custom parameters to send to the authorization request URL or the OAuth authorization sever.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Resource Owner Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Identifier to store the OAuth authentication attributes (accessToken, refreshToken, etc). This attribute is required only when applications access resources from more than one user in the OAuth authentication server.</p></div></div></td><td><div><div><p>default</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Encode Client Credentials In Body</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If <code>true</code>, the client ID and client secret are sent in the request body. Otherwise, the client ID and client secret are sent as basic authentication.</p></div></div></td><td><div><div><p>true</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application identifier defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application secret defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Scopes</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Scope required by the application to execute. Scopes define permissions over resources.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager configuration to use for the grant type.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server URL to get access to the token. Mule calls this URL to get the access token, after receiving the authentication code from the OAuth server through the <code>redirectUrl</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Response Access Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the access token parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.access_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Refresh Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Response refresh token.</p></div></div></td><td><div><div><p><code>#[payload.refresh_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Expires In</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the expires in parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.expires_in]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Custom Parameter Extractors</strong></p></td><td><div><div><p>Array of <a href="#ParameterExtractor">Parameter Extractor</a></p></div></div></td><td><div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Refresh Token When</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Enables expressions to evaluate against the HTTP response of the API callback to determine if the request failed because it was done using an expired token. If the evaluation returns <code>true</code> (access token expired), Mule automatically triggers a refresh token flow and retries the API callback using a new access token. Default value evaluates if the response status code is <code>401</code> or <code>403</code>.</p></div></div></td><td><div><div><p><code>#[attributes.statusCode == 401 or attributes.statusCode == 403]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Tls Context</strong></p></td><td><div><div><p><a href="#Tls">TLS</a></p></div></div></td><td><div><div><p>A TLS configuration to receive incoming HTTP requests and do HTTP requests during the OAuth dance.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Parameter Extractor

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Param Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Parameter extractor name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Value</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Value for this type.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr></tbody></table>

### TLS

Configures TLS to provide secure communications for the Mule app.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Enabled Protocols</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Comma-separated list of protocols enabled for this context.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Enabled Cipher Suites</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Comma-separated list of cipher suites enabled for this context.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Trust Store</strong></p></td><td><div><div><p><a href="#TrustStore">Truststore</a></p></div></div></td><td><div><div><p>Configures the TLS truststore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Store</strong></p></td><td><div><div><p><a href="#KeyStore">Keystore</a></p></div></div></td><td><div><div><p>Configures the TLS keystore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Revocation Check</strong></p></td><td><div><div><ul><li><p><a href="#standard-revocation-check">Standard Revocation Check</a></p></li><li><p><a href="#custom-ocsp-responder">Custom OCSP Responder</a></p></li><li><p><a href="#crl-file">CRL File</a></p></li></ul></div></div></td><td><div><div><p>Revocation check configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Truststore

Configures the truststore for TLS.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to the truststore. Mule resolves the path relative to the current classpath and file system.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Password</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Password used to protect the truststore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Type of store.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Algorithm</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Encryption algorithm that the truststore uses.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Insecure</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If <code>true</code>, Mule stops performing certificate validations. Setting this attribute to <code>true</code> make connections vulnerable to attacks.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Keystore

Configures the keystore for the TLS protocol. The keystore you generate contains a private key and a
public certificate.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to the keystore. Mule resolves the path relative to the current classpath and file system.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Type of store.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Alias</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Alias of the key to use when the keystore contains multiple private keys. By default, Mule uses the first key in the file.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Key Password</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Password used to protect the private key.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Password</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Password used to protect the keystore.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Algorithm</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Encryption algorithm that the keystore uses.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Standard Revocation Check

Configures standard revocation checks for TLS certificates.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Only End Entities</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Which elements to verify in the certificate chain:</p></div><div><ul><li><p><code>true</code><br>Verifies only the last element in the certificate chain.</p></li><li><p><code>false</code><br>Verifies all the elements in the certificate chain.</p></li></ul></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Prefer Crls</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>How to check certificate validity:</p></div><div><ul><li><p><code>true</code>+ Checks the Certification Revocation List (CRL) for certificate validity.</p></li><li><p><code>false</code>+</p></li></ul></div><div><p>Checks the Online Certificate Status Protocol (OCSP) for certificate validity.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>No Fallback</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Whether to use the secondary method to check certificate validity:</p></div><div><ul><li><p><code>true</code><br></p></li></ul></div><div><p>Uses the method not specified in the <strong>Prefer Crls</strong> field to check the certificate validity.</p></div><div><ul><li><p><code>false</code></p></li></ul></div><div><p>Does not use the method specified in the <strong>Prefer Crls</strong> field to check certificate validity.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Soft Fail</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>What to do if the revocation server can’t be reached or is busy:</p></div><div><ul><li><p><code>true</code></p></li></ul></div><div><p>Avoids verification failure.</p></div><div><ul><li><p><code>false</code></p></li></ul></div><div><p>Enables the verification to fail.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Custom OCSP Responder

Configures a custom OCSP responder for certification revocation checks.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>URL of the OCSP responder.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Cert Alias</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Alias of the signing certificate for the OCSP response. If specified, the alias must be configured in the truststore.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### CRL File

Specifies the location of the certification revocation list (CRL) file.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to the CRL file.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

### Client Credentials Grant Type

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Encode Client Credentials In Body</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If true, the client ID and client secret are sent in the request body. Otherwise, the client ID and client secret are sent as basic authentication.</p></div></div></td><td><div><div><p>false</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Client Id</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application identifier defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Client Secret</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Application secret defined in the OAuth authentication server.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Scopes</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Scope required by the application to execute. Scopes define permissions over resources.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Manager</strong></p></td><td><div><div><p><a href="#token-manager-config">Token Manager Config</a></p></div></div></td><td><div><div><p>The token manager configuration to use for the grant type.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Token Url</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The OAuth authentication server URL to get access to the token. Mule calls this URL to get the access token, after receiving the authentication code from the OAuth server through the <code>redirectUrl</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Response Access Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the access token parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.access_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Refresh Token</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Response refresh token.</p></div></div></td><td><div><div><p><code>#[payload.refresh_token]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Response Expires In</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Expression to extract the expires in parameter from the response of the call to <code>tokenUrl</code>.</p></div></div></td><td><div><div><p><code>#[payload.expires_in]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Custom Parameter Extractors</strong></p></td><td><div><div><p>Array of <a href="#ParameterExtractor">Parameter Extractor</a></p></div></div></td><td><div><div><p>Custom parameter extractors configuration.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Refresh Token When</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>Enables expressions to evaluate against the HTTP response of the API callback to determine if the request failed because it was done using an expired token. If the evaluation returns <code>true</code> (access token expired), Mule automatically triggers a refresh token flow and retries the API callback using a new access token. Default value evaluates if the response status code is <code>401</code> or <code>403</code>.</p></div></div></td><td><div><div><p><code>#[attributes.statusCode == 401 or attributes.statusCode == 403]</code></p></div></div></td><td><div></div></td></tr><tr><td><p><strong>TLS Context</strong></p></td><td><div><div><p><a href="#Tls">TLS</a></p></div></div></td><td><div><div><p>A TLS configuration to receive incoming HTTP requests and do HTTP requests during the OAuth dance.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## See Also

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=9fe91729dc6ba3d8ca0a311a2244cb80836ac69bc1dbbf9a9400c817ffef2692 url=/mulesoft/current/en-us/oauth-module/latest/oauth-xml-maven.md -->

---
product: OAuth Module
version: 1.1
is-latest-version: true
---

# OAuth Module XML and Maven Support

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio.

If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML
editor or from a text editor, you can get access to the connector in your app by adding reference
statements to both your XML Mule flow and the Apache Maven `pom.xml` file.

When you add the connector in Studio, Studio automatically populates the XML code with the
connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file.

## Add a Namespace for the Connector

Paste the following code inside the `<mule>` tag of the header of your configuration XML:

```xml
http://www.mulesoft.org/schema/mule/oauth
http://www.mulesoft.org/schema/mule/oauth/current/mule-oauth.xsd
```

This example shows how the namespace statements are placed in the `<mule>` XML block:

```xml
<mule xmlns:oauth="http://www.mulesoft.org/schema/mule/oauth"
	xmlns:ee="http://www.mulesoft.org/schema/mule/ee/core"
	xmlns:http="http://www.mulesoft.org/schema/mule/http"
	xmlns:file="http://www.mulesoft.org/schema/mule/file"
	xmlns="http://www.mulesoft.org/schema/mule/core"
	xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.mulesoft.org/schema/mule/core
	http://www.mulesoft.org/schema/mule/core/current/mule.xsd
	http://www.mulesoft.org/schema/mule/file
	http://www.mulesoft.org/schema/mule/file/current/mule-file.xsd
	http://www.mulesoft.org/schema/mule/http
	http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd
	http://www.mulesoft.org/schema/mule/ee/core
	http://www.mulesoft.org/schema/mule/ee/core/current/mule-ee.xsd
	http://www.mulesoft.org/schema/mule/oauth
	http://www.mulesoft.org/schema/mule/oauth/current/mule-oauth.xsd">
```

## Add a POM File Dependency

The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app.
If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to
this connector:

```xml
<dependency>
  <groupId>org.mule.modules</groupId>
  <artifactId>mule-oauth-module</artifactId>
  <version>x.x.x</version>
  <classifier>mule-plugin</classifier>
</dependency>
```

Replace `x.x.x` with the version that corresponds to the connector you are using.

To obtain the most up-to-date `pom.xml` file information:

1.  Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/).

2.  In Exchange, click **Login** and supply your Anypoint Platform username and password.

3.  In Exchange, search for `oauth module`.

4.  Select the connector.

5.  Click **Dependency Snippets** near the upper right of the screen.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=526828c48c113d8881d93f5bdcd56a0c491d73630fefe281b3369b4f44d374bd url=/mulesoft/current/en-us/oauth-module/latest/oauth-module-troubleshooting.md -->

---
product: OAuth Module
version: 1.1
is-latest-version: true
---

# Troubleshooting OAuth Module

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To troubleshoot OAuth module, become familiar with the information about enabling verbose logging
and interpreting commonly throw messages.

## Enable Verbose Logging

To get a better understanding of why an application’s interaction with OAuth module is failing,
temporarily enable verbose logging for the module.

Remember to always disable the enhanced verbosity after troubleshooting, because it affects your
Mule application performance.

To enable verbose logging in the configuration file:

1.  Access Anypoint Studio and navigate to the **Package Explorer** view.

2.  Open your application’s project name.

3.  Open the `src/main/resources` folder.

4.  Open the `log4j2.xml` file inside the folder.

5.  Add an `<AsyncLogger>` tag inside the `<Loggers>` tag:

    ```xml
    			<Loggers>
    				...
    				<AsyncLogger name="org.mule.extension.oauth2" level="DEBUG"/>
    				...
    			</Loggers>
    ```

6.  Save your application changes.

7.  Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule
    Application**.

## Understand Common Throws

Here is a list of common thrown messages and how to interpret them:

- HTTP:SECURITY

  Occurs when there is an error related to an HTTP request.

## See Also

- [Salesforce Help](https://help.salesforce.com)

- [Known Issues](https://help.salesforce.com/s/issues)