Skip to content

OAuth 2.0 Configuration

Overview

OAuth 2.0 Configuration in the Admin Console defines platform token endpoints, token format, signing algorithms, and expiry settings used by the API gateway for OAuth-protected APIs.

Open Security → OAuth 2.0 in the Admin Console sidebar.

Each organization can have one active OAuth configuration. Only users with admin security permissions can create or edit it.

Why This Matters

  • Central OAuth server settings for token issuance and validation across the platform.
  • Supports JWT and opaque access tokens.
  • Required prerequisite for Yappes OAuth in API Manager — without this configuration, API providers cannot select Yappes OAuth as an authentication type and see the message "OAuth configuration is not set up by your administrator."
  • After configuration, API providers, consumers, and approvers follow the end-to-end flow in Yappes OAuth.

Scope

  • Create or edit the single OAuth configuration for your organization.
  • Configure token URLs, token format, signing, and expiry settings.
  • View the auto-generated well-known metadata endpoint.

Prerequisites

  • Admin Console access with security configuration permissions.
  • OAuth server endpoints reachable from the gateway.

Endpoints

Field Label Editable Validation
tokenUrl Access Token URL * Yes Required; valid http:// or https:// URL
refreshTokenUrl Refresh Token URL * Yes Required; valid http:// or https:// URL
wellKnownUrl Well Known URL Read-only Auto-generated; not sent on save

Each URL field has a copy button.

The Well Known URL is an auto-generated, read-only endpoint that publishes OAuth server metadata for discovery. After save, the platform may normalize token URLs to platform endpoints (for example, {domain}/api/oauth2/token) and set the well-known URL to {domain}/.well-known/openid-configuration?organizationId=....

Info

Token URLs entered in the form may be normalized to platform endpoints when saved. The values displayed after a successful save reflect the resolved platform URLs.

Token Settings

Field Options Default unit
Access Token Format * JWT, Opaque —
Signing Algorithm * RS256, RS384, RS512, ES256, HS256 (JWT only) —
Access Token Expiry * Value + secs / mins / hours secs
Refresh Token Expiry * Value + secs / mins / hours / days days

Gateway validation is applied automatically based on the selected token format. No separate validation mode is required or configurable beyond the options below.

Expiry validation: values must be numeric, greater than 0.

The Signing & Encryption section appears only when JWT is selected as the access token format. It is hidden when Opaque is selected.

Signing & Encryption (JWT only)

Field Options
Key Rotation Policy * Automatic
Token Validation Mode * Automatic

These fields are required when the access token format is JWT.

Step-by-Step: Create Configuration

Step 1: Open OAuth 2.0

  • Go to Security → OAuth 2.0.

Step 2: Fill endpoints and token settings

  • Enter Access Token URL and Refresh Token URL.
  • Select Access Token Format.
  • If JWT is selected, choose Signing Algorithm and complete Signing & Encryption fields.
  • Enter Access Token Expiry and Refresh Token Expiry with appropriate units.

Step 3: Save

  • Click Create Configuration.
  • On success, the form switches to view mode with all fields disabled.

Step 4: Edit an existing configuration

  • Click Edit Configuration in the page header.
  • Modify the required fields.
  • Click Save, or Cancel to discard changes and return to view mode.

Note

Saving without changes shows the error "Please modify values to initiate an update." The Save button is disabled while the form has validation errors.

How This Connects to API Manager

  1. Admin saves OAuth configuration in the Admin Console.
  2. API Manager reads the OAuth configuration saved in the Admin Console.
  3. API providers select Yappes OAuth during API onboarding — access and refresh token URLs are prefilled from admin config.
  4. Consumers receive per-application client credentials after subscription and use the configured token endpoints to obtain access tokens.

For provider, consumer, and approver steps, see Yappes OAuth.

flowchart LR
    AdminConsole[Admin Console OAuth 2.0 Config] --> PlatformOAuth[Platform OAuth Server]
    PlatformOAuth --> APIManager[API Manager Yappes OAuth]
    APIManager --> Gateway[API Gateway]
  • Yappes OAuth — API Manager end-to-end guide (provider, consumer, approver)
  • API Authentication — upstream OAuth 2 for Tryout (distinct from Yappes OAuth)
  • SSO Setup — single sign-on for console login (unrelated to platform OAuth config)