My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?

Why this happens

With OAuth 2.0, Cyberlop mints a token by client credentials and puts it in a header at scan time. Tokens expire. A long scan can outlive a short token, and your API then answers with a rejection.

How to fix it

1. Open the profile and go to Authentication.
2. In the OAuth 2.0 block, find AI guidance.
3. Add one line per step. The form suggests Prefer the freshly minted OAuth 2.0 access token and If a request is rejected, re-mint rather than reusing an expired token.
4. Click Complete authentication to confirm a token is issued.
5. Click Save and run the scan again.

Check your token service as well. If the lifetime of a token is very short, ask your admin to lengthen it for the scan client.

Two lines of guidance are usually enough. One says which token to prefer, the other says what to do on a rejection. Anything longer tends to blur the message, and the scanner has to follow every line you write. Keep it plain.

Still not working?

Confirm the Header name and Header prefix match what your API expects. The defaults are Authorization and Bearer . If rejections continue, check that the Scope gives the client enough access. See what to check when no token comes back, or write to /contact.

Related questions

• Complete authentication didn't return a token. What should I check?
• How does Cyberlop use OAuth 2.0 client credentials during a scan?
• What kind of instructions belong in a role's AI guidance?
• How do I change the header name or prefix the OAuth token is sent with?
• How do I test the OAuth token exchange before running a scan?

Full tutorial

OAuth client credentials in Cyberlop: scan APIs with a minted token

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre