OAuth 2.0 Get Token Step

The OAuth2 Authentication step obtains an access token from an OAuth 2.0 / OpenID Connect provider and stores it in a variable for use in subsequent steps.

When to Use

• Testing APIs protected by OAuth 2.0 / OIDC.
• Automating token acquisition as part of a test flow.
• Refreshing tokens during long-running suites (refresh is supported for Authorization Code, Client Credentials, Device Code and ROPC).

Why: Many APIs reject requests without a valid bearer token. Centralizing token acquisition in one step keeps credentials out of individual request definitions and lets you reuse the token across a suite.

Quickest Scenario (Client Credentials)

1. Add the OAuth2 Authentication step.
2. In the Grant Type pill, choose Client Credentials.
3. In Access & Endpoints, set the Token Endpoint (or paste a discovery URL and click search Discover).
4. In Client Identity, set Client ID and Client Secret.
5. In Test Step Output, set Variable Name (default access_token) and Variable Scope.
6. Reference it later: Authorization: Bearer ${access_token}.

Header: Authorization = Bearer ${access_token}

Grant Types

The Grant Type segmented pill selects the flow. The visible fields change per flow.

Flow (UI)	Flow type	Browser / interaction
Client Credentials	ClientCredentials	None (service-to-service)
Auth Code	AuthorizationCode	Browser (manual or automation script)
Implicit	Implicit	Browser (WebDriver, token in URL fragment)
Device Code	DeviceCode	Browser or automation script (user code)
ROPC	ResourceOwnerPassword	None (username/password)

Discovery

Enter a Discovery Endpoint (e.g. https://server/.well-known/openid-configuration) and click Discover. The OpenID Connect discovery document auto-fills the endpoint URLs and available scopes.

Client Credentials

Field	Description
Token Endpoint	Provider's token URL.
Refresh Endpoint	Optional; used to refresh the token.
Client ID	Application client identifier.
Client Auth Method	SharedSecret (client_secret) or ClientAssertion (private key JWT).
Client Secret	Required for SharedSecret. Stored encrypted.
Private Key JWT	Signing key provider (PEM/JWK/PFX/X.509/symmetric) for ClientAssertion. The Client Assertion Type is fixed to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

Authorization Code / Implicit

Adds Authorization Endpoint, Redirect URI (read-only, auto-managed), and, for Authorization Code, an optional Use JAR (JWT Secured Authorization Request, RFC 9101) toggle. PKCE is enabled by default.

Device Code

Adds a Device Authorization Endpoint. During a run, the step shows an info Action Required info bar with the verification URL and user code; it polls the token endpoint until authorized or the login timeout elapses. An automation script can fill the login form instead.

ROPC (Resource Owner Password)

Shows a Resource Owner section with Username and Password (both support ${VariableName} substitution).

warning

ROPC is deprecated in OAuth 2.1. Prefer Client Credentials or Authorization Code with PKCE.

Security Options

Option	Description
Require PKCE	(Auth Code / Implicit) Sends a code_challenge. Enabled by default.
Enable DPoP	Attaches a DPoP proof JWT (RFC 9449). security Reserved for a future release — not yet implemented.

Browser & Automation

Visible for Authorization Code, Implicit and Device Code. Toggle Automation Script to drive the login form with a Selenium-style script; when enabled you can also set Headless Mode. The Edit automation script button opens the script editor.

Additional & Auto-Managed Parameters

• Additional Parameters — extra name=value pairs sent with the request.
• Auto-Managed Parameters — read-only Response Mode, Response Type, Redirect URI, State and Nonce, managed by the OAuth handler.

Test Step Output

Field	Description
Variable Name	Name of the variable holding the access token (default access_token).
Variable Scope	Where the token is saved: TestCase, TestSuite (default) or Project.
Force Re-Authentication	Ignore any cached token and re-authenticate.
Login Timeout	Maximum time (10 s – 3600 s) to wait for login to complete.

The step writes the access token to ${VariableName} at the chosen scope and records the expiry (Valid until: …) in diagnostics. LastAccessToken is available for diagnostics display.

tip

Tokens are cached per environment keyed by the step Id and reused until expiry, unless Force Re-Authentication is on.

Example: Full OAuth2 Test Flow

Step 1: OAuth2 Authentication (Client Credentials)
        → stores token in ${access_token}  (scope: TestSuite)

Step 2: Send Request (GET /api/protected-resource)
        Header: Authorization = Bearer ${access_token}

Step 3: Assert (Status Code = 200)

See Also

• JWT Step
• Send Request Step