Skip to content

How to Use OAuth2 for the Client Credentials Grant Type

OAuth2 authentication can be implemented in various ways, depending on the collection structure and specific requirements. You can configure OAuth2 at either the collection level or request level.

OAuth2 Configuration

Select OAuth 2.0 as the authentication method and set the grant type to Client Credentials. Fill in the following required fields:

  • Access Token URL: The endpoint to obtain the access token
  • Client ID: Your application's client identifier
  • Client Secret: Your application's client secret
  • Scope: (Optional) The requested scope
  • Add Credentials to: Choose how to send credentials (Request Body or Basic Auth Header)

When using client certificates with OAuth2 client credentials, ensure your domain uses wildcard patterns (e.g., *.domain.com) instead of specific subdomains. This ensures proper certificate matching and prevents "Bad credentials" errors.

Token Configuration and Usage

Before getting the access token, configure how you want to use it in your requests:

  1. Token Usage Configuration:

  2. Add token to: Specify how the token should be included in requests:

    • Headers: Adds the token to request headers with a configurable prefix (default: "Bearer").
    • URL: Adds the token as a URL query parameter with a configurable parameter name (default: "access_token").

  3. Token Management Settings:

  4. Auto-fetch: When enabled, Bruno will automatically fetch a new token when you try to access a resource and don't have a valid token.
  5. Auto-refresh: When enabled, Bruno will automatically refresh your token using the refresh URL when it expires.

These settings streamline your workflow by reducing manual token management. Auto-refresh is particularly useful for long-running operations or testing sessions.

You may optionally assign a Token ID to your token. If you do, you can reference this token in requests using the format {{$oauth2.<tokenId>.access_token}} (replace <tokenId> with your Token ID).

If you use the same Token ID in multiple OAuth requests, Bruno will overwrite the existing token data. Make sure to use unique Token IDs for different OAuth configurations.

  1. Click Get Access Token to obtain and store the token.

You can click the 'Clear Cache' button to remove the stored token and request a new one.