Home / Help centre / Authentication & logins
Authentication & logins
Why is the Complete authentication button greyed out?
The Complete authentication button stays disabled until the OAuth 2.0 fields hold values. Enter the Token URL, Client ID and Client secret on the role. Scope is optional. Once they hold values, the button turns on and you can test the token exchange.
Why this happens
The button has a tooltip: Complete the OAuth2 client-credentials exchange and check that a token comes back. It cannot run that exchange with no details to send, so the app keeps it off until the required fields hold values.
How to fix it
- Open the profile and go to Authentication.
- Under Authentication methods, tick OAuth 2.0.
- Type the Token URL, for example
https://auth.example.com/oauth2/token. - Add the Client ID and the Client secret.
- Add a Scope if your token service needs one.
- Click Complete authentication.
| Field | What to enter |
|---|---|
| Token URL | The address that issues tokens |
| Client ID | The ID of your client |
| Client secret | The secret for that client |
| Scope | Optional |
| Header name | Authorization by default |
| Header prefix | Bearer by default |
Header name and Header prefix already have defaults. Change them only if your API expects something else.
The tooltip on the button describes its job: it completes the exchange and checks that a token comes back. Run it each time you change the Token URL, the client details or the scope, because a quick test now costs far less than a scan that fails an hour in. Short test, clear answer.
Still not working?
When the fields are full and the button stays grey, reload the page and fill them again. If the button works but no token comes back, read what to check when Complete authentication returns no token. For anything else, use /contact.
Related questions
- Complete authentication didn't return a token. What should I check?
- How do I test the OAuth token exchange before running a scan?
- How do I set up OAuth 2.0 client credentials for a role?
- How do I request a specific OAuth scope for the scanner's token?
- How do I change the header name or prefix the OAuth token is sent with?
OAuth client credentials in Cyberlop: scan APIs with a minted token
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.