Home / Help centre / Authentication & logins
Authentication & logins
How does Cyberlop use OAuth 2.0 client credentials during a scan?
Cyberlop uses the client-credentials exchange to mint a token from the Token URL you store on the role, then injects it as a header (Authorization with a Bearer prefix by default) when the scan runs. You store the URL, client ID and secret, never the token itself.
The short version
The scanner mints a token with the OAuth 2.0 client-credentials exchange and injects it as a header when the scan runs. The role holds the token URL, client ID and secret. Nobody pastes a token.
How it works in Cyberlop
On a role, tick OAuth 2.0 and fill in Token URL, Client ID, Client secret and an optional Scope. At scan time, Cyberlop asks the token URL for a token and sends it under the Header name with the Header prefix. The defaults are Authorization and Bearer .
| Step | Who does it |
|---|---|
| Store URL, client ID, secret, scope | You, on the role |
| Test the exchange | You, with Complete authentication |
| Mint the token and add the header | Cyberlop, at scan time |
The optional AI guidance can tell the scanner what to do when things go wrong. The placeholder lines suggest using the fresh token first, and minting a new one when a request fails, instead of reusing an expired one. Nothing in the capture says how often the scanner mints a token, so do not rely on a fixed schedule.
Compare this with a plain header token: that value stays as you typed it, while OAuth 2.0 gets a new token from your provider each time.
What to do next
Follow the setup steps and test with the exchange check. If a scan hits rejections, read what to do when the token fails mid-scan. Use a client made for scanning and test only what you have permission to test.
Related questions
- How do I set up OAuth 2.0 client credentials for a role?
- How do I test the OAuth token exchange before running a scan?
- How do I change the header name or prefix the OAuth token is sent with?
- My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?
- Complete authentication didn't return a token. What should I check?
OAuth client credentials in Cyberlop: scan APIs with a minted token
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.