Generating POP Tokens for OAuth 2.0 Credentials

Generate Proof of Possession (POP) tokens that can be called for each and every request as a secure authentication method. When creating an OAuth 2.0 credential type, you can create a unique certificate to leverage with the token, which can be configured directly in the application with unique names and custom expiration dates.

Customers can identify the JWT-type token value from the x-authorization key presented in the request's Header.

Note:

POP tokens for OAuth 2.0 are currently under preview. Please contact OneTrust Support to submit a request for early access.

About POP Tokens & Certificates

  • When certificates expire, you will need to create a new certificate in the given credential's Credential Details screen. You will not need to create an entirely new credential.

  • A new POP token is regenerated for each new request made. This is different than OAuth Access Tokens, which are valid for a select duration as defined by the customer but systematically generated by OneTrust.

To create an OAuth 2.0 credential

  1. On the Integrations menu, select Credentials.

    The Credentials screen appears.

  2. Click the Add credential button.

    The Select existing system screen appears.

  3. Enter your system in the Select System field, then click the Next button.

    The Enter Credential Details screen appears.

  4. Provide a unique name and description for this credential.
  5. You will need to specify the Application type as Web App and the Authentication method as OAuth 2.0.
  6. Complete the remaining fields (e.g. Hostname, Default Headers, Access Token URL) as necessary to customize this credential to your connection needs.
  7. Enable the setting, Enable Proof of Possession Tokens, to populate additional fields to secure connections with a certificate. This will only appear with the Auth Type field selected with OAuth 2.0.


    Field
    Description
    Create New Certificate

    Choose this option to open a new modal in order to provide a unique name and enter the specific number of days (no limit) for the expiration.

    Certificates created in this manner will be immediately available for selection in the Select Existing Certificate field.

    Select Existing Certificate

    Choose this option to select an existing certificate.

  8. Click the Copy Public Key button to copy the generated public key for the certificate to utilize, which will be stored on the client's side.
  9. Complete the remaining fields (e.g. Authentication Parameters, MTLS) as necessary to configure your credential.
  10. Click the Save button.
  11. You can now select this credential when configuring connection actions. For more information, see the following resources: