OAuth 2.0 client credentials

Many integration platforms and GRC tools expect OAuth 2.0 rather than a static API key. An OAuth client gives them that: the platform holds a client ID and secret, asks Coverbase for a bearer token when it needs one, and uses the token until it expires, at most an hour later. The token reaches exactly what an ak_* key reaches. Endpoint details are in the OAuth API reference.

When to use it

Use	When
An `ak_*` API key	Your integration can keep one long-lived secret and send it on every call.
An OAuth client	Your platform has an OAuth 2.0 client credentials connection type, your security policy prefers short-lived tokens, or you want to narrow a token’s scopes per job.

Both authenticate as your organization’s API service account. The IP allowlist, the public API audit log and every route’s permissions apply the same way.

Step 1: Create the client

Open Configuration and choose API keys.
Under OAuth Clients, click New client.
Give it a Name, such as “GRC sync”.
Under Elevated Scopes, choose any scopes the integration needs. Most need none, which the list shows as Standard access. Only an admin signed in to the dashboard can grant scopes.
Click Create client.
Copy the Client ID and Client Secret, store the secret in your platform’s secret store, and click I saved the secret. The secret is not shown again.

Tokens from a client made on this page last one hour. To create a client with a shorter token lifetime, from five minutes up, use POST /v1/api-oauth-clients with access_token_ttl_seconds.

Step 2: Configure your platform

In your integration platform’s OAuth 2.0 client credentials connection, enter:

Setting	Value
Token URL	`https://api.coverbase.app/v1/oauth/token`
Client authentication	HTTP Basic (client ID and secret in the `Authorization` header). Sending them as form fields instead also works, but never both in one request.
Grant type	`client_credentials`
Scope	Leave empty for every scope the client holds, or list a subset, space-separated
Token placement	`Authorization: Bearer <access_token>`

Step 3: Test it

cURL

TOKEN=$(curl -s -X POST "https://api.coverbase.app/v1/oauth/token" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials" | jq -r .access_token)

curl -H "Authorization: Bearer $TOKEN" https://api.coverbase.app/v1/utils/authtest

{"msg": "Auth successful"} means the token works. Request a new token when expires_in runs out. This grant has no refresh token. Reuse a token until it expires: a client holds at most 50 live tokens, and requesting a 51st revokes its oldest.

Revoke

On the API keys page, click Revoke on the client and confirm Revoke client. The client can no longer get tokens, and its current tokens stop working. A server that cached a token can keep accepting it for a few seconds. Last Token shows when each client last asked for a token, which helps find clients nobody uses.

Troubleshooting

What you see	Cause	Fix
No OAuth Clients section on the API keys page	The third-party lifecycle features are not on for your organization, or you are not an admin.	Ask your Coverbase representative, or an admin.
`401 invalid_client`	Wrong client ID or secret, or the client is revoked.	Check both values. Create a new client if the secret is lost.
`400 unsupported_grant_type`	`grant_type` is missing, or the body was sent as JSON.	Send `grant_type=client_credentials`, form-encoded.
`400 invalid_scope`	The token request asks for a scope the client was not granted.	Request fewer scopes, or create a client with the scope.
`403 insufficient_scope` on a call	The token lacks a scope the endpoint needs.	Request the scope when getting the token, if the client holds it.
`403 ip_not_allowed`	Your platform’s egress IP is outside the allowlist.	Add it to the IP allowlist.

OAuth API

The token endpoint and client management.

API conventions

Authentication, scopes, errors and pagination.

Integration platforms

Workato, MuleSoft and Boomi.

Integration credentials and signing

How client secrets are stored.

Getting started

API reference

Data import and export

Field reference

Integration workflows

AI, agents and MCP

OAuth 2.0 client credentials

When to use it

Step 1: Create the client

Step 2: Configure your platform

Step 3: Test it

Revoke

Troubleshooting

OAuth API

API conventions

Integration platforms

Integration credentials and signing

​When to use it

​Step 1: Create the client

​Step 2: Configure your platform

​Step 3: Test it

​Revoke

​Troubleshooting

​Related

OAuth API

API conventions

Integration platforms

Integration credentials and signing

When to use it

Step 1: Create the client

Step 2: Configure your platform

Step 3: Test it

Revoke

Troubleshooting

Related