# Custom Connector client\_credentials flow **URL:** \ **Category:** Questions\ **Created:** [March 14, 2025, 3:47pm UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609 "2025-03-14T15:47:52Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 14, 2025, 3:47pm UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/1 "2025-03-14T15:47:52Z")
I have an API that requires an access token, which can be obtained using the following request: ### **Access Token Request** ```bash curl --location 'https://test.com/v2/oauth2/clientcredentials/accesstoken' \ --header 'Accept: application/json' \ --header 'x-apikey: abcd' \ --header 'Authorization: Basic sdfdsbbvdd==' \ --header 'grant_type: client_credentials' ``` ### **Response** ```json { "token_type": "BearerToken", "issued_at": "1741951640345", "access_token": "SdLUzPZ0Q8EqsWGnSq3PYVyuFbXN", "scope": "", "expires_in": "1799", "status": "approved" } ``` Once the access token is obtained, I need to use it for a second API request: ### **Second API Request** ```bash curl --location --globoff 'https://test.com/testservice/api/v1/guests' \ --header 'Accept: application/vnd.api+json' \ --header 'Authorization: Bearer SdLUzPZ0Q8EqsWGnSq3PYVyuFbXN' \ --header 'x-apikey: abcd' ``` ### **Questions:** 1. How can I configure a **Custom Connection Builder** for this flow? 2. What authentication method should I use, given that **Basic Auth did not return an access token**? 3. How can I extract the `access_token` from the API response in an automated way? 4. If using **OAuth 2.0 Client Credentials Flow** , how do I pass `Username:Password` in **Base64 encoded format** in the first request? Any insights or guidance would be greatly appreciated! ![Screenshot 2025-03-14 at 9.19.35 PM](https://global.discourse-cdn.com/oktadev/original/2X/9/94e05df317688a7bf9454f0dddcc64830cf0f618.png) ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 14, 2025, 4:41pm UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/2 "2025-03-14T16:41:57Z")
Hi @sachin34, Can you share what API you use? > How can I configure a Custom Connection Builder for this flow? A connector consists of several flows: - A flow to make HTTP requests. - A flow to check authentication to the service is working. - One or more action flows. Each action flow calls a service’s API endpoint. We have a [tutorial](https://www.okta.com/blog/2024/05/workflows-connector-builder-oauth-tutorial/) showing how to build a custom connector to Spotify. It uses an Authorization Code instead of Client Credentials, but the general steps will be similar. > What authentication method should I use, given that Basic Auth did not return an access token? Use Basic authentication since that’s what the first API call uses to request an access token. > How can I extract the `access_token` from the API response in an automated way? You will use a connection to get the access token. A connection you use for testing the connector (in the Connector Builder) will be listed under Test Connections. When building a flow, a user using your connector will create a connection (like they do today with any action card). > If using OAuth 2.0 Client Credentials Flow, how do I pass Username:Password in Base64 encoded format in the first request? The connection will pass the Client ID and Client Secret as username:password (in Base64). ![Screenshot 2025-03-14 at 9.32.12 AM](https://global.discourse-cdn.com/oktadev/original/2X/8/8116367937bfa83d21e4fa46a992eb1a2530687d.png) ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 16, 2025, 11:49am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/3 "2025-03-16T11:49:09Z")
Thank you @maxkatz for your response, I have a private API used internally within my organization. My understanding of setting up the connection for the connector builder is to bypass the authentication call. However, since my API uses Basic Auth and I cannot extract the access token directly, I now need to handle it manually. My approach is to create an `httpHelper` flow that: 1. Calls the first API to extract the access token. 2. Manually creates a header object with `Bearer `. 3. Triggers the second API using the generated header. I was exploring whether there’s a way to avoid making two API calls in this scenario. ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 17, 2025, 2:44am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/4 "2025-03-17T02:44:08Z")
Hi @sachin34, Can you call your API from the Internet? You can only call a public API in Workflows. Maybe we first call your API using the API Connector card. Can you share the docs for the API? I highly recommend you read [Understanding Okta Workflows Connectors](https://www.okta.com/blog/2024/03/okta-workflows-connectors/) to learn about various options for calling APIs in Workflows. ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 17, 2025, 3:36am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/5 "2025-03-17T03:36:04Z")
Yes, the API is accessible over the internet and is secured behind Apigee. To access it, we first call Apigee’s authentication endpoint using the X-ApiKey to obtain an access token. This access token is then used to make a second API call to `/testservice`. Sure @maxkatz Will go through the documentation which you suggest, Thank you so much for your help ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 17, 2025, 4:02am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/6 "2025-03-17T04:02:50Z")
This helps. Then, you would set up Authentication in the connector: ![image](https://global.discourse-cdn.com/oktadev/original/2X/4/4cd8e012a2e3383c0a101c2e4d6b009feb721a1d.png) Then, you can start building the first connector flow: httpHelper. The connector will pass the connection information (the token) to this flow, and you can make the API call. ![image](https://global.discourse-cdn.com/oktadev/original/2X/6/68513ba5c33677545c0da8592f58620d592da283.png) ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 17, 2025, 4:37am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/7 "2025-03-17T04:37:51Z")
HI @maxkatz , I attempted to set up authentication in the connector using the `client_credentials` flow. However, my initial authentication call requires a header with the key `"Authorization"` and a value in the format `"Basic "`. In the `client_credentials` flow, the connection sends the Client ID and Client Secret as `username:password` in Base64 encoding. ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 17, 2025, 5:01am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/8 "2025-03-17T05:01:49Z")
Could you try Basic Authentication [https://help.okta.com/wf/en-us/content/topics/workflows/connector-builder/authentication-basic.htm](https://help.okta.com/wf/en-us/content/topics/workflows/connector-builder/authentication-basic.htm)? ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 17, 2025, 5:05am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/9 "2025-03-17T05:05:47Z")
Yes @maxkatz Basic Authentication works, but is there a way to extract the access token from the response? ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 17, 2025, 5:53am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/10 "2025-03-17T05:53:08Z")
You are correct. Basic won’t work here. When you tried client\_credentials, did you set the ‘Client Authentication Type’ to ‘Send as basic auth header’? ![image](https://global.discourse-cdn.com/oktadev/original/2X/3/380c358972f4aa8d714e21e75cf063342ea5d8bc.png) Can you share the request the connection sends and the error message? ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 17, 2025, 6:16am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/11 "2025-03-17T06:16:48Z")
Yes @maxkatz , i set the ‘Client Authentication Type’ to ‘Send as basic auth header’ , but somehow i am unable to make the connection, Error is : Failed to connect, Not sure where can i debug the request & response ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 17, 2025, 3:52pm UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/12 "2025-03-17T15:52:38Z")
I successfully set up an OAuth 2.0 (Client Credentials) connection to Spotify. I received an access token and made an API call. This is my connector’s connection: ![image](https://global.discourse-cdn.com/oktadev/original/2X/5/52954f7c8581f1d80c95ca5a35021c6549992d47.png) For testing, you need to set up a connection: ![image](https://global.discourse-cdn.com/oktadev/original/2X/1/1129ce7ec795feb402f280240cefae64656af31b.png) ![image](https://global.discourse-cdn.com/oktadev/original/2X/2/2ecc1825560f47b99008101a413baf032011b494.png) I get the access token inside the httpHelper flow: ![image](https://global.discourse-cdn.com/oktadev/original/2X/e/eaecb5b7014abb41b7519815211f5b93f318a32e.png) Can you share your set up screenshots? ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 18, 2025, 1:02am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/13 "2025-03-18T01:02:00Z")
Hi @maxkatz , Thank you so much for your response in this, my requirement for obtaining an access token is as follows: curl --location --request GET ‘[https://test.com/v2/oauth2/clientcredentials/accesstoken](https://test.com/v2/oauth2/clientcredentials/accesstoken)’ –header ‘Accept: application/json’ –header ‘x-apikey: ’ –header ‘Authorization: Basic \’ –header ‘grant\_type: client\_credentials’ Using basic authentication, as shown in the screenshot below, I am able to establish a connection. ![Screenshot 2025-03-18 at 5.54.37 AM](https://global.discourse-cdn.com/oktadev/original/2X/a/a539a338bfa2a83e48776d9c622749d2c5d4d6c5.png) ![Screenshot 2025-03-18 at 6.10.54 AM](https://global.discourse-cdn.com/oktadev/original/2X/e/e4a3065c2bac2d24522d8b5dcef86752bb4824c3.png) ![Screenshot 2025-03-18 at 6.09.12 AM](https://global.discourse-cdn.com/oktadev/original/2X/2/2b5f542ee2a0e9edbde809409fb486193cf4c886.png) However, with this authentication type, there is no way to extract the access token from the response. I need to understand how to set the header values in this approach. Where can I specify custom header values such as `x-apiKey` and `grant_type` in the OAuth 2.0 (Client Credentials) flow? I tried the following approach but failed to establish the connection. The error suggests that the headers were not set correctly. ![Screenshot 2025-03-18 at 6.15.57 AM](https://global.discourse-cdn.com/oktadev/original/2X/9/99bd56d2b6a407668786842fc81536d5ebef15cc.png) ![Screenshot 2025-03-18 at 6.16.16 AM](https://global.discourse-cdn.com/oktadev/original/2X/c/c27f251619ad329f78016fd209219f44c844a25c.png) ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 18, 2025, 1:36am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/14 "2025-03-18T01:36:18Z")
Hi @sachin34, You shouldn’t need the ‘grant\_type’ parameter. Did you try placing the ‘x-apikey’ under Config Values? ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 18, 2025, 2:21am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/15 "2025-03-18T02:21:00Z")
Yes @maxkatz , I tried but failed to establish the connection. Upon debugging, I found the following error: Unauthorized-Failed to resolve API Key variable request.header.x-apikey ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 18, 2025, 4:07am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/16 "2025-03-18T04:07:30Z")
I will find out what’s the correct format to send the extra header parameter. ---
**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\ **Post date:** [March 18, 2025, 7:29pm UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/17 "2025-03-18T19:29:26Z")
Hi @sachin34, I found out more about this. > [@sachin34](#): > > curl --location --request GET ‘[https://test.com/v2/oauth2/clientcredentials/accesstoken’](https://test.com/v2/oauth2/clientcredentials/accesstoken%E2%80%99) > –header ‘Accept: application/json’ > –header ‘x-apikey: ’ > –header ‘Authorization: Basic \’ > –header ‘grant\_type: client\_credentials’ The above request, with the x-apikey header, appears to be a non-standard OAuth and the Connector Builder doesn’t support it. You can add the API key parameter, the request will inlcude it in the body: ![image](https://global.discourse-cdn.com/oktadev/original/2X/8/81a011df78bce954737b6965b38ae35dd416cc88.png) You will have access to in a flow: ![image](https://global.discourse-cdn.com/oktadev/original/2X/8/834ae16b1a46851cf57f2eafd8f4f47f0bfd1d75.png) ---
**Author:** ![sachin34](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@sachin34](https://devforum.okta.com/u/sachin34)\ **Post date:** [March 20, 2025, 11:51am UTC](https://devforum.okta.com/t/custom-connector-client-credentials-flow/32609/18 "2025-03-20T11:51:13Z")
Thank you @maxkatz, really appreciate you looking into this.