# Scim oauth implementation

**URL:** <https://devforum.okta.com/t/scim-oauth-implementation/14921>\
**Category:** OAuth/OIDC\
**Created:** [June 28, 2021, 2:11pm UTC](https://devforum.okta.com/t/scim-oauth-implementation/14921 "2021-06-28T14:11:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aviadh](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aviadh](https://devforum.okta.com/u/aviadh)\
**Post date:** [June 28, 2021, 2:11pm UTC](https://devforum.okta.com/t/scim-oauth-implementation/14921/1 "2021-06-28T14:11:15Z")

</div>

hi,  
I would like to authenticate my scim with OAuth with SCIM 2.0 Test App (Header Auth) application. Do you have a guide on how to do that? from what I understand I need to pass the access token and somehow to veridy that at my application. Do you have a go implementation?

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [July 13, 2021, 6:38pm UTC](https://devforum.okta.com/t/scim-oauth-implementation/14921/2 "2021-07-13T18:38:25Z")

</div>

Hi @aviadh! We don’t have an official guide but I am happy to walk you through the process.

We have an OAuth authentication option with our SCIM 2.0 Template App; you may search for it under Applications \> Browse App Integration Catalog \> SCIM 2.0 Test App (OAuth Bearer Token).

Things to note:

1. You may use Okta as an authorization server or another authz server of your choice.
2. Okta supports OAuth 2.0 [Authorization Code Flow Grant](https://developer.okta.com/docs/guides/implement-auth-code/overview/).
3. You can manually test the access token within the template app like so:

 ![Testing SCIM OAuth](https://global.discourse-cdn.com/oktadev/original/2X/7/7cd5ca94e440e92b6857f2ffc907d42744c1e15f.png)

but one caveat is that although you can configure for refresh tokens, there is currently no way to test this within the app - this feature is soon to come.

1. Once you submit your SCIM integration ([https://oinmanager.okta.com/](https://oinmanager.okta.com/)) you will need to provide Okta with a client id and client secret as well as the necessary endpoints:

 ![Screen Shot 2021-07-13 at 10.30.16 AM](https://global.discourse-cdn.com/oktadev/original/2X/f/fcdaf79216d69d990d0fb489f5a88a27c615dd89.png)

And once your app is integrated into our OIN, then refresh tokens will automatically work as intended.

1. We include the Client ID/Client Secret provided in the **body** of the request we send to the provided Token endpoint, NOT the **headers**

Lastly, we don’t have a Go implementation specifically for OAuth-SCIM setup, but I recommend taking a look at our [Go Resource Server Sample](https://github.com/okta/samples-golang/tree/master/resource-server) which uses the [Okta JWT Verifier for Golang](https://developer.okta.com/docs/guides/validate-access-tokens/go/overview/#decoding-and-validating-the-access-token) to validate access tokens.

Additional resources:

- [SCIM - frequently asked questions | Okta Developer](https://developer.okta.com/docs/concepts/scim/faqs/)
- Example SCIM implementation - [Prepare your SCIM service | Okta Developer](https://developer.okta.com/docs/guides/build-provisioning-integration/prepare-api/#example-implementations)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 6:44pm UTC](https://devforum.okta.com/t/scim-oauth-implementation/14921/3 "2024-02-08T18:44:13Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.