Accessing Pega DX-API through OAuth 2.0

[@somilshukla8498]

Great video . I have a confusion here please resolve this . When pega is client , and when to create oauth profile , and when this client registration comes into picture ?

[@debsubs5627]

If you give a video on how to pass , password via dynamic reference it will be helpful

[@Qtometa]

You need to use oauth or some other auth process, basic won’t help you.

[@MrPraveensiva]

Awesome content 👍. In oauth, we should make two calls, one to get the token with the client I'd and secret and other is to make the actual service call with the token. If pega is oauth client, then we can create the auth profile of type oauth and configure the client I'd and secret that we got from the oauth service provider. Though pega is making a call to get the token, it's all buried inside the engine code. As an end user, we could see that we are hitting the resource url and getting the data. Here, we could see that using the postman we are making the two calls one for token and other for service. Could you please make a video that in real-time how client ( actual system which treats pega as service provider) is making the token call and the service call. I think token call is not needed for every time till it is expired. How the client knows that the token is expired?

[@Qtometa]

You need to make two call from external app, however not each time, for every token we will have some expiration time..till that time you can use same token. Auth profile is required when you’re means pega acting as client.

[@MrPraveensiva]

@@Qtometa Yes, pega acting as a client requires the auth profile. If possible, please make a video on real time scenario how external system consumes pega service assuming pega is the oauth provider. In this video, i understand the concept through postman about the token generation and service call with token.

[@matchalattepocs]

Thanks for the comment. Does pega need to to be Authorisation provider/Token Provider for the Pega hosted Service Resource. How does it work in case we use Azure or GCP as a Authorisation provider. How does Pega Service ( Resource provider) introspect the client token? I have seen this flow for OIDC Authentication(which is again based on oauth2.0), just wondering if its the same flow and steps for Pega Service using Oauth2 as well ? any comments ?

[@MatthewHenderson-u3c]

Hello, thanks for the content, it's really useful! However, I keep running into an "invalid_client" error. Do you know what the possible cause of this may be? The error message says the response must include a WWW-Authenticate header but I have added the Content-Type = application/x-www-form-urlencoded.

[@Qtometa]

Hello, what kind of authentication you’re using in service package?

[@MatthewHenderson-u3c]

@@Qtometa I've tried to follow your video step by step to use OAuth 2.0 but I am having an issue when authorizing the client id and secret. Any ideas?

[@MatthewHenderson-u3c]

@@Qtometa The only part I was unsure about was the Operator ID, I tried to use an admin one, then I tried to use my personal user id but I got the same error with both

[@MatthewHenderson-u3c]

@@Qtometa Are there any pre-requisite steps to this tutorial if I were to start from scratch? (e.g. with a free trial account)

[@Qtometa]

​@@MatthewHenderson-u3c Need to see how you'r doing, if we follow steps properly it should work.