# Protect custom application API using only OAuth2

**URL:** <https://devforum.okta.com/t/protect-custom-application-api-using-only-oauth2/21104>\
**Category:** Questions\
**Created:** [June 29, 2022, 12:24pm UTC](https://devforum.okta.com/t/protect-custom-application-api-using-only-oauth2/21104 "2022-06-29T12:24:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevekum](https://avatars.discourse-cdn.com/v4/letter/s/76d3ee/32.png) [@stevekum](https://devforum.okta.com/u/stevekum)\
**Post date:** [June 29, 2022, 12:24pm UTC](https://devforum.okta.com/t/protect-custom-application-api-using-only-oauth2/21104/1 "2022-06-29T12:24:29Z")

</div>

Hi,

We have custom APIs built for our application. We want external customers to access these API through OAUTH2. Since this will be a machine-to-machine communication, we do NOT want to use Open ID connect for this.

How to protect custom APIs using ONLY OAUTH2 in Okta for the various different external partners?

Please help.

Thanks  
Steve

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [June 30, 2022, 7:06pm UTC](https://devforum.okta.com/t/protect-custom-application-api-using-only-oauth2/21104/2 "2022-06-30T19:06:18Z")

</div>

It sounds like you’ll want to use [Client Credentials flow,](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/) in which case, I would recommend creating individual applications (OIDC Service Apps) within your Okta org for each customer/partner. They will then use the Client ID/Secret for this application to get tokens from, Okta that can be used as authorization to your API.

Your API would then [validate the token](https://developer.okta.com/docs/guides/validate-access-tokens/), both to ensure its unexpired, the signing key matches an expected value, and that it contains the expected information, and grant them access to your APIs accordingly. Since each partner would have their own application, your APIs could use that information (stored within the token claims, such as how the client ID will be available in the `sub` claim by default) to determine the appropriate access for each partner.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 12, 2024, 8:58pm UTC](https://devforum.okta.com/t/protect-custom-application-api-using-only-oauth2/21104/3 "2024-02-12T20:58:15Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.