home

Zuora Platform

Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies
Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies

Welcome to Zuora Product Documentation

Explore our rich library of product information

Show Contents

thumbnailZuora Platform

Manage OAuth 2.0 clients

Create OAuth tokens for automated user management in Okta

Create an OAuth 2.0 client using the authorization code grant type by configuring settings, managing clients, and specifying necessary fields.

  • You have administrator access to the OneID portal.

  • Your IdP (for example, Okta) is already configured in OneID.

  • You have the Okta app's unique identifier (the value that appears in the App Embed link) ready.

OneID uses the OAuth 2.0 authorization code flow to authenticate requests to the SCIM API. To enable automated user management from Okta (or another IdP), you first create an OAuth 2.0 client in OneID. The client generates a client ID and client secret that your IdP uses to request authorization codes and access tokens. Once configured, your IdP can automatically provision, update, and deprovision users in Zuora through the OneID SCIM API.

  1. In the upper-right corner of the OneID portal, click your avatar, and then click Settings.

    The Settings page opens.

  2. Click Manage OAuth 2.0 Clients.
  3. On the Manage OAuth 2.0 Clients page, click New.

    The New OAuth 2.0 Client window opens.

  4. Specify the following fields:

    • Name: Enter a descriptive name for the client, for example, Okta SCIM Provisioning. This name helps you identify the client on the Manage OAuth 2.0 Clients page.

    • Authorization Grant Type: Select Authorization Code from the list. This grant type is required for the OAuth 2.0 authorization code flow used by the OneID SCIM API.

    • Type: Select SCIM Client (IdP) from the list. This option configures the client for SCIM-based user provisioning from an external IdP.

    • App Name: Enter the unique identifier of the Okta app, which appears in the App Embed link in the Okta admin console.

      Figure 1. App Embed link in Okta
      Okta App Embed link showing the unique app name identifier used as the App Name value in OneID.

    • IdP Provider: Select your IdP from the list. This associates the OAuth 2.0 client with the IdP that will request tokens.

    • Scopes: Select the authorization scope from the list. The scope determines which SCIM API operations the client is permitted to perform (for example, reading or modifying user records).

  5. Click Save.

    After the client is created, a window displays the client ID and client secret.

  6. Copy the client ID and client secret, and store them in a secure location, such as your IdP's credential store or a secrets manager.
    Important: The client secret is displayed only once. If you lose it, you must create a new OAuth 2.0 client to generate a new secret. Your IdP uses the client ID and client secret to request authorization codes and access tokens for the OneID SCIM API.

The OAuth 2.0 client is now available on the Manage OAuth 2.0 Clients page. Your IdP can use the client credentials to authenticate with OneID and automate user management through the SCIM API.

Configure your IdP (for example, the SCIM provisioning settings in your Okta app) with the client ID, client secret, and the OneID SCIM API endpoint to start automated user provisioning.

Last updated: June 15, 2026