How do I set up OAuth 2.0 client credentials for a role?

Steps

1. Add or open a role in Authentication and tick OAuth 2.0.
2. Type your provider's token endpoint in Token URL, for example https://auth.example.com/oauth2/token.
3. Enter the Client ID and the Client secret. Use a client made for scanning, with no more access than the test needs.
4. Add a Scope only if your provider needs one. Leave the Header name as Authorization and the Header prefix as Bearer unless your API differs.
5. Click Complete authentication. It runs the client-credentials exchange and checks that the provider hands back a token.
6. Finish with Save.

Good to know

At scan time the scanner asks your provider for a token and sends it as a header, so you never paste a token yourself. The secret stays in its own field.

The Complete authentication button stays greyed out until you fill in the fields. If the check fails, read why the OAuth check fails. For a longer explanation, see how the token works during a scan. The method follows the OAuth client-credentials style. Only test apps you have permission to test.

Keep the client small. Give it only the access the test needs, and revoke it once the scan work ends.

Related questions

• How do I test the OAuth token exchange before running a scan?
• How do I request a specific OAuth scope for the scanner's token?
• How do I change the header name or prefix the OAuth token is sent with?
• How does Cyberlop use OAuth 2.0 client credentials during a scan?
• Complete authentication didn't return a token. What should I check?

Full tutorial

OAuth client credentials in Cyberlop: scan APIs with a minted token

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre