# How to perform OAuth Client Credentials Flow

**URL:** <https://community.easymorph.com/t/how-to-perform-oauth-client-credentials-flow/3952>\
**Category:** Articles\
**Created:** [October 6, 2022, 5:32pm UTC](https://community.easymorph.com/t/how-to-perform-oauth-client-credentials-flow/3952 "2022-10-06T17:32:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![olysak](https://community.easymorph.com/letter_avatar_proxy/v4/letter/o/aeb1de/32.png) [@olysak](https://community.easymorph.com/u/olysak)\
**Post date:** [October 6, 2022, 5:32pm UTC](https://community.easymorph.com/t/how-to-perform-oauth-client-credentials-flow/3952/1 "2022-10-06T17:32:52Z")

</div>

~~EasyMorph does not support OAuth Client Credentials Flow out of the box~~ (UPDATE - supports, see [below](https://community.easymorph.com/t/how-to-perform-oauth-client-credentials-flow/3952/2)) , but since this flow is rather minimalistic, you can get by with using basic Web request / Parse JSON actions.

To obtain authorization token using Client Credentials Flow you have to:

# 1. Make a POST request to your OAuth Server

Request body should be in `application/x-www-form-urlencoded` form and should contain at least `client_id`, `client_secret` and `grant_type` fields. The first two fields should equal to your client id and secret, respectively, and `grant_type` should be `client_credentials`. You may have to specify `scope` field to, but that field is optinal and application-specific, e.g. it's value depends on what are you authorizing against.

The `Web request` action to perform such request could look like this:

 ![image](https://community.easymorph.com/uploads/default/original/2X/e/e623e757ebc1df6d6de3e1c5a9a45ca05b9df826.png)

# 2. Parse JSON response.

Regardless of request being in `application/x-www-form-urlencoded`, we always get response in `application/json` form. In case of Client Credentials Flow response should look something like this

```auto
{
	'access_token': '<access token>',
	'expires_in': 'expiration time',
	'scope': 'if present, actual access scopes granted',
	'token_type': 'Bearer'
}

```

Actually we're interested only in `access_token` field.

# 3. Extract access\_token and use it

Suppose we need to be authorized to call to some protected endpoint. Using Parse JSON action we pick `access_token` field from the response, append `Bearer ` string to it (that's required by convention) and finally use this string as `Authorization` header value when making actual request to protected endpoint:

## Parse JSON:

 ![image](https://community.easymorph.com/uploads/default/original/2X/b/b5116298048f7afc04441d2d686ba90c68b4ce5a.png)

## Append `Bearer` string:

 ![image](https://community.easymorph.com/uploads/default/original/2X/3/391713d2b7d69bfb8623563ffdc0e5bcaedfe1aa.png)

## And, finally, make actual request to `/some-protected-endpoint`:

 ![image](https://community.easymorph.com/uploads/default/original/2X/4/4de8afbff158dc2ec27ccb738491133323025d11.png)

---

<div class="post-metadata">

**Author:** ![dgudkov](https://community.easymorph.com/user_avatar/community.easymorph.com/dgudkov/32/5_2.png) [@dgudkov](https://community.easymorph.com/u/dgudkov)\
**Post date:** [December 13, 2024, 8:03pm UTC](https://community.easymorph.com/t/how-to-perform-oauth-client-credentials-flow/3952/2 "2024-12-13T20:03:56Z")

</div>

UPDATE

The OAuth client credentials flow is now natively supported in the "Web location" parameter.

 ![image](https://community.easymorph.com/uploads/default/original/2X/4/4f8fbef6eb670e0919ca6cc6d669a7b0dd6201db.png)