OAuthToken Connection

Access level: read

OAuth 2.0 is an Authorization Framework and an open standard for access delegation that is used by a variety of HTTP service providers. This connection type provides an access token for an HTTP service using OAuth2 Standard. It can also be referenced in REST connections with authentication method "Token", but there are some limitations.

With OAuth connections, one authorization request can be performed during execution and can be used for several subsequent REST calls. The result of this connection is JSON and can be consumed directly by a JSON extract.

In an OAuthToken connection's successful response, the authorization server issues an access token and an optional refresh token. The authorization server constructs the response by adding parameters to the entity-body of the HTTP response.

According to the specification "The OAuth 2.0 Authorization Framework", a successful response requires access_token and token_type parameters. An expires_in parameter is recommended, along with the optional refresh_token and scope parameters.

Connection settings

To obtain details such as Client ID and Client secret, refer to Microsoft's documentation on Application ID. The following settings are always available, regardless of the authentication method selected.

Setting Description
Token endpoint The URL address of the source data, for example https://abc.example.com/resource.
Authentication method Determines which additional settings appear. Select one of the following methods:
Client ID A unique string representing the registration information provided by the client.
Client secret The client secret key known only to the application and the authorization server. Enter the secret key decoded; Jedox handles any required encoding.
Access token scope Optional. Specifies the scope of the access request as a list of space-delimited, case-sensitive strings defined by the authorization server.
Client authentication type Determines how client credentials are sent to the authorization server:
  • None — no client authentication type is applied.
  • basicAuthHeader — the client credentials are included in the request header, using the HTTP basic authentication scheme.
  • body — the client credentials are included in the request body.
Additional request parameters Optional name/value pairs of request parameters for the web service; required for the GET method. The request parameter can be anything, as it is specific to the URL used. For example, you may need to authorize access to Azure Active Directory web applications using the OAuth 2.0 code grant flow.

Authentication method settings

The oauth2ClientCredential method requires no settings beyond those in Connection settings above. The oauth2PasswordCredential and oauth2RefreshToken methods each require one additional setting, described below.

Password credentials settings

Grant type "Resource Owner Password Credentials". In addition to the settings in Connection settings, this method requires the following.

Setting Description
User name The user name of the resource owner.
Password The password of the resource owner.

Refresh token settings

Grant type "Refreshing an Access Token". In addition to the settings in Connection settings, this method requires the following.

Setting Description
Refresh token mode Determines how the refresh token is supplied:
  • Manual input: one input field, Token connection (encrypted; can be entered as a text or encrypted variable). A manual update is necessary to reactivate the OAuthToken connection once the refresh token expires.
  • Automatic refresh: two input fields, Scope and Setting. The key for the refresh token must be created manually with the "Password" type in Jedox Web Settings. If the refresh token expires during an execution, a new refresh token is generated and stored in the Settings manager under the same setting and scope, so no manual update is required.

Advanced settings

The following settings apply regardless of the authentication method selected.

Setting Description
SSL mode
  • verify — checks the certificate; if the response is OK, the certificate is validated.
  • trust — imports the certificate to the keystore, if not already available.
  • off — no SSL is used.
Timeout (in s) The timeout of the web service request, in seconds.
Ignore cookies policy By default (unchecked), a warning ("Cookie rejected") appears when the HTTP call breaks a cookie policy — for example, due to an incorrect domain in the set-cookie header. The OAuth connection still returns a result. If checked, the warning does not appear.
Cache token By default (unchecked), Jedox requests a new access token on every call. If checked, Jedox reuses a previously obtained access token instead of requesting a new one, for as long as it remains valid based on the expires_in value returned by the authorization server. A new token is requested once that validity window expires.

Notes

  • Some OAuth providers, including Microsoft, have deprecated the Resource Owner Password Credentials grant used by the oauth2PasswordCredential method due to security concerns. Verify with your provider whether this grant type is still supported before configuring this method.

Updated October 5, 2026