home

Zuora Platform

Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies
Zuora BillingZuora PaymentsZuora PlatformZuora CPQZephrZuora RevenueAccounts ReceivableZuora AIRelease NotesBasicsEntitlementsSupport and policies

Welcome to Zuora Product Documentation

Explore our rich library of product information

Show Contents

thumbnailZuora Platform

Manage OAuth 2.0 clients

Create OAuth tokens for user management APIs in One ID

Learn how to create an OAuth 2.0 client using the client credentials grant type in the OneID portal.

  • You have an administrator role in OneID with permission to manage OAuth 2.0 clients.

  • You have identified the scope (for example, organization-level access) that your integration requires.

  • You have a secure location, such as a secrets manager, in which to store the generated client secret.

To automate user and organization management tasks, OneID exposes a set of SCIM 2.0-based user management APIs. These APIs are protected by OAuth 2.0 and require a bearer access token in every request. To obtain an access token, you must first create an OAuth 2.0 client in the OneID portal by using the client credentials grant type. This grant type is intended for server-to-server (machine-to-machine) integrations where no end user is involved, such as provisioning users from your HR system or synchronizing organization membership from an external directory.

When you create the client, OneID issues a client ID and a client secret. Your application exchanges these credentials at the OneID token endpoint for a short-lived access token, which it then includes in the Authorization: Bearer <token> header when calling the user management APIs. The scope you select on the client (for example, Organization) determines which resources the resulting token can access.

  1. In the upper-right corner of the OneID portal, click your avatar, and then click Settings.

    The Settings page opens.

  2. Click Manage OAuth 2.0 Clients.
  3. On the Manage OAuth 2.0 Clients page, click New.

    The New OAuth 2.0 Client window opens.

  4. Specify values for the following fields:

    • Name: Enter a descriptive name for the client, such as the name of the integration or application that will use it. This helps you identify the client later on the Manage OAuth 2.0 Clients page.

    • Authorization Grant Type: Select Client Credentials from the dropdown list. This grant type is required for server-to-server access to the user management APIs.

    • Scope Type: Select Organization from the dropdown list. An organization-scoped client can manage users and resources within the organization in which it is created.

  5. Click Save.

    After the client is created, a window that contains the client ID and client secret opens.

  6. Copy the client ID and client secret, and then store them in a secure location.
    Important: The client secret is displayed only once and cannot be retrieved later. If you lose the client secret, you must create a new OAuth 2.0 client and update any integrations that depend on it.

You can now use the client ID and client secret to request an OAuth 2.0 access token from the OneID token endpoint, and then include that token in the Authorization header when you call the OneID user management APIs. For details about token requests and supported API endpoints, see the OneID API reference.

Last updated: June 11, 2026