--- title: "OAuth Authentication" slug: "oauth-authentication" updated: 2024-05-20T05:20:57Z published: 2024-05-20T05:20:57Z canonical: "help.symphonysummitai.com/oauth-authentication" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.symphonysummitai.com/llms.txt > Use this file to discover all available pages before exploring further. # OAuth Authentication **OAuth Authentication** enables user access to third-party applications without sharing their login credentials, issuing access tokens to grant permission to user accounts. Add OAuth Authentication **To add a new** **OAuth** **Configuration, perform the following steps.** 1. Navigate to **Platform Studio** > **Access Control Center** > **Add** **Authentication** > **OAuth**. 2. Select **OAuth** from the **Authentication Types**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704375155181.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: OAuth 3. Click **Add OAuth Configuration** to add a new instance for **Authentication** type. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704375298691.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Add OAuth 4. Click **Next** to move to the next screen to enter the configuration details. ### Create User If **OAuth** Tab is selected, then Super Admin should enter the following general properties as shown in the screenshot. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704375356958.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704375429352.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D) Figure: OAuth Configuration screen The table shows the list of attributes for enabling the **OAuth** **Configuration**. Table | Field | Description | | --- | --- | | Name | Specify a name for the OAuth configuration in the **Name** field. | | Logo* | Upload the **Logo** for SAML configuration here. Choose the image for Logo and click **Uplo****ad**. | | Client ID* | Enter the public identifier value for the field. **Client ID** is the application ID from the Okta portal used to identify and authenticate your application when it communicates with Okta for user authentication and authorization purposes. | | Grant Type* | Select the **Grant Type** as **Authorization Code** or **Implicit** by expanding the Grant Type dropdown. **Grant Type** is used to specify the method or flow by which a client application obtains an access token from an OAuth 2.0 authorization server. If you select **Authorization Code,** the application allows the user to enter the code after logging in. If Implicit is selected, the application immediately gets access to the information after logging in. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704375660195.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Grant Type | | Login URL* | Specify the **Login URL** under the field. The login URL is where users input their authentication credentials, like usernames and passwords, to access their accounts or protected resources within the system. | | Redirect URL* | Type the **Redirect URL** here. It is the URL used for redirecting the User to a specific page after SSO. This is the same URL you have specified in the Redirect URL field of the Okta portal. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1678871134366.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Redirect URL | | Token Endpoint URL* | Specify the **Token Endpoint URL** under the field. It is a web service that clients (applications) use to request access tokens from the authorization server.![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1678870987559.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Token Endpoint URL | | User Information Endpoint URL* | Enter the **User Information Endpoint URL**. This endpoint provides a way for client applications to obtain information about the authenticated user after getting an access token. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1691994580112.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: User Information Endpoint URL | | Issuer* | Type the URL of the **Issuer**. It is the URL that identifies your OAuth identity provider. | | Response Attribute* | Select the option **Email** or **User Principal Name** or **Better** by expanding the **Response Attribute** drop-down list. If you select **Email**, when the user authorizes an application using OAuth, they will be asked to grant access to their email address as part of their profile information. For **User Principal Name**, the user account name (in an email address format) in an email system should specify the email provider's domain name. Better: More detailed user information. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704375919164.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Response Attribute | | Scope | Specify the Scope ( openid, profile, email) for the field. | | Refresh Redirect URL | Enter the URL for URL for Refresh Redirect for the field.![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1678871374825.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Refresh Redirect | | Logo* | Choose the image for Logo and click the **Uplo****ad**. | | Logout URL | Specify the URL for sending a logout request to the OAuth provider to log out from the provider. | | Two Factor Authentication | Enable the check for Two Factor Authentication.![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1691992149610.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Check box If you click **Two Factor Authentication**, you can choose the type of **Login Type** from the field list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374141461.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Enable Two Factor Authentication | | Create User | Enable the box ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1691992230403.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D) to create user. Specify the **Timezone** from the drop-down list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374260872.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Timezone ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374364463.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Timezone list Select the Roles for the User from the drop-down list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374610398.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D)Figure: Roles | To save the **Configuration**, click **Submit**. The Authentication is configured successfully. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704456088309.png?sv=2026-02-06&spr=https&st=2026-10-26T20%3A59%3A31Z&se=2026-10-26T21%3A59%3A31Z&sr=c&sp=r&sig=xrj0e0Su%2BnKpoMRZItcJp2N1uiYxRWo3fuwldBAahBA%3D) Figure: OAuth Configuration **Note** - Image width should be less than 300px. - Image height should be less than 48px. - Supported Image format: .gif, .jpeg, .jpg, .png, .bmp. Upon enabling this checkbox, the user is created if that user is not available in the database but wants to login into the application using the authentication method. **Note** - Image width should be less than 300px. - Image height should be less than 48px. - Supported Image format: .gif, .jpeg, .jpg, .png, .bmp. It specifies the level of access and the types of information that the client application is requesting from the OpenID Connect provider (OP) about the authenticated user. Type of scopes are: 1. openid: Indicates that the client is requesting basic OpenID Connect authentication services. 2. profile: It requests access to the user's basic profile information. 3. email: It allows client application to retrieve user's email address, facilitating communication, identification. It refers to the endpoint or location where the client application expects to receive the response after successfully refreshing an access token in OAuth authentication. This URL is specified by the client application during the initial OAuth authorization process and is used by the authorization server to redirect the user back to the client application after token refresh.