How do I test the OAuth token exchange before running a scan?

Steps

1. Tick OAuth 2.0 on the role and fill in Token URL, Client ID and Client secret. Add a Scope if you use one.
2. Hover over Complete authentication. The tooltip says it completes the client-credentials exchange and confirms that a token comes back. The button stays disabled until you fill in the fields.
3. Click the button and wait for the result.
4. If a token comes back, press Save. If not, fix the field that looks wrong and try again.

Good to know

This check can save you a wasted scan, because it answers one question quickly and in plain view.

It also lets you try small changes without committing to a full run, which helps when you tune the scope or header details with a provider that is slow to answer your questions.

This check saves you a wasted scan. A typo in the token URL or the secret shows up in seconds instead of an hour into a run.

Behind the button is an operator endpoint, POST /api/oauth2/verify, which mints and verifies an OAuth2 token. It needs the permission profile:manage_credentials. If your user lacks it, ask a workspace admin. Admin screens are not covered in this guide, so use /contact for help.

• Check the token URL first. It is the most common slip.
• Check that your provider lets the client use client credentials.
• Look at the scope, if you set one.

The test does not prove that your API will accept the token. It proves that the exchange works. For the next step, read why the OAuth check fails if you see an error. Test only systems you have permission to test.

Related questions

• Complete authentication didn't return a token. What should I check?
• Why is the Complete authentication button greyed out?
• How do I set up OAuth 2.0 client credentials for a role?
• How do I request a specific OAuth scope for the scanner's token?
• How does Cyberlop use OAuth 2.0 client credentials during a scan?

Full tutorial

OAuth client credentials in Cyberlop: scan APIs with a minted token

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre