Complete authentication didn't return a token. What should I check?

Why this happens

The button runs the real client-credentials exchange against your Token URL. It fails when the URL is wrong, when the ID or secret is wrong, when the scope is not allowed, or when the client is not set up for client credentials. It can also fail if your account lacks permission to verify credentials.

How to fix it

1. Open the OAuth 2.0 block on the role.
2. Compare the Token URL with the one in your identity provider. A typo or a missing path is common.
3. Retype the Client ID and Client secret together.
4. Add or fix the Scope. Leave it empty if your service does not use one.
5. Click Complete authentication again.
6. If the button errors straight away, ask an admin whether your role holds profile:manage_credentials.

The exchange is the same one the API calls POST /api/oauth2/verify. It mints a token and checks it, and it needs that permission.

Write down what you tried and what the button did. A note such as the Token URL used, the scope used and the time of the attempt makes any support request quicker to answer, because the cause is then easy to narrow down. Never include the secret itself in a message.

Still not working?

Check that the client is allowed to use the client-credentials grant in your identity provider. Header name and prefix do not affect whether a token is issued. If the token comes back but the API refuses it, see when your API rejects the token. Our team can help at /contact.

Related questions

• Why is the Complete authentication button greyed out?
• How do I test the OAuth token exchange before running a scan?
• My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?
• How do I set up OAuth 2.0 client credentials for a role?
• Why does my API call return a permission error?

Full tutorial

OAuth client credentials in Cyberlop: scan APIs with a minted token

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre