OAuth 2.0 is a widely-used authorization framework that enables third-party applications to obtain limited access to user accounts on an HTTP service. Apidog can directly generate OAuth 2.0 tokens according to the specification and attach them to requests automatically, eliminating the need to generate tokens in external tools.Authorization Grant Types#
OAuth 2.0 supports multiple authorization grant types, each suited for different use cases. Select the appropriate grant type based on your application's requirements and the API provider's specifications.| Grant Type | Use Case | Security | When to Use |
|---|
| Authorization Code | Server-side web apps | High | Most common flow for web applications |
| Authorization Code (With PKCE) | Mobile/SPA apps | Very High | Enhanced security for public clients |
| Implicit | Browser-based apps (legacy) | Medium | Deprecated, use PKCE instead |
| Password Credentials | Trusted first-party apps | Medium | Direct username/password exchange |
| Client Credentials | Machine-to-machine | High | Service-to-service authentication |
Choose the grant type that matches your API provider's requirements. Using the wrong grant type will result in authentication failures.
Configuration: Authorization Code#
The Authorization Code flow is the most secure and commonly used OAuth 2.0 flow for web applications.Required Fields#
| Field | Description | Source |
|---|
| Auth URL | The authorization endpoint URL | API provider's OAuth documentation |
| Access Token URL | The token endpoint URL | API provider's OAuth documentation |
| Callback URL | Your application's redirect URI | Your application (must be registered with provider) |
| Client ID | Your application identifier (App ID) | API provider's developer console |
| Client Secret | Your application secret (App Secret) | API provider's developer console |
Obtaining a Token#
1.
Fill in all required fields in the OAuth 2.0 configuration
2.
Click the Get Token button
3.
A login page will pop up in your browser
4.
Complete the login and authorization process
5.
The login page will automatically close
6.
The token will be automatically obtained and displayed
Authorization header with the Bearer prefix.Token Type Selection#
If the OAuth 2.0 service returns both Access Token and ID Token, Apidog will use the Access Token by default.To use the ID Token instead, select ID Token in the "Token Type Used" option. This is useful when working with OpenID Connect (OIDC) implementations.
Token Refresh#
If Refresh Token is available:A Refresh Token button will appear
Click it to obtain a new access token without re-authenticating
No login window will pop up
Click the Obtain Token Again button
A login window will pop up for re-authentication
Switching Login Accounts#
OAuth 2.0 login pages typically remember your login status. To change accounts:1.
Click the Clear Cookies button
3.
Log in with a different account
Advanced Settings#
Click the Advanced option to configure additional OAuth 2.0 parameters. If left blank, they will be generated automatically.| Setting | Description | Purpose |
|---|
| Scope | Authorization scope | Limits the range of resources to be accessed |
| State | Random string parameter | Prevents Cross-Site Request Forgery (CSRF) attacks |
| Credentials | How to send client credentials | Send as Basic Auth header or Send client credentials in body |
| Refresh Token URL | Custom refresh endpoint | Use if different from Access Token URL |
| HTTP Authorization Prefix | Token prefix in header | Default is Bearer, customize if needed |
Always use the State parameter to prevent CSRF attacks. Apidog generates this automatically if left blank.
FAQs#
When setting up OAuth2.0 authentication for your API in Apidog, you may need to register an official redirect URI in your authorization server or client settings. This ensures the OAuth flow can complete successfully and that Apidog can receive the access token after authorization.
β
Apidog's Official Redirect URI:If your API uses the OAuth2.0 Authorization Code Flow, and you are configuring client settings (such as in your OAuth provider or Identity Platform), then you should add this URI to the "Redirect URIs" or "Callback URLs" field. 
