Skip to main content

Celonis Product Documentation

Registering your OAuth client in Celonis Platform

OAuth can be used as an authentication method for Celonis Platform, which offers a more secure and flexible way of granting permissions to clients (applications) compared to API keys.

For an overview of the differences between OAuth 2.0 and using Application or API Keys, see: Using OAuth 2.0.

 

To register your OAuth clients in Celonis Platform:

  1. In your Celonis Platform instance, go to Admin & Settings > Applications.

  2. In the upper-right corner, click Add new application and select OAuth Client.

  3. Give your connection a meaningful name.

  4. The supported OAuth grant type is “Client Credentials”.

  5. Select one of the following authentication methods:

    • Client secret basic: With this method, the client uses the Authorization header to send the client_id and client_secret in the following format: Authorization: Basic encoded_credentials.

      Here the value of encoded_credentials corresponds to the base64 encoding of OAuth client’s client_id:client_secret.

    • Client secret post: The client authenticates itself by providing the client_id and client_secret in the HTTP request body as a form parameter.

  6. Click Define scopes.

    Scopes allow you to define areas to which the client should have access within its current permissions. You can't grant additional permissions to a client using scopes.

  7. Select resource types within Celonis Platform to which the clients will have access based on granted permissions. Chosen scopes give the client access to specific Celonis Platform APIs.

  8. Click Create.

As scopes only allow access to the APIs, the created OAuth client should now be assigned permissions to resources behind those APIs. After creating a client in Celonis Platform, developers receive client credentials: client ID and client secret. Every scope should have a name and a description, which unambiguously explains which APIs can be accessed with the scope based on the permissions granted to the client.

Regenerating OAuth client secrets

For security reasons, you may want to regenerate the client secret using the following steps:

  1. In your Celonis Platform instance, go to Admin & Settings > Applications.

  2. Find your OAuth client and click the three-dot menu next to it.

  3. Select Regenerate secret.

Once you generate a new client secret, make sure to update the secret in all integrations that use that client.

Managing OAuth Client Consent

During OAuth authorization flows, users can give consent to OAuth clients to access resources on their behalf. To view which OAuth clients have been granted consent, go to Edit Profile and then to the section OAuth Client Management. From there you can view which applications (OAuth clients) have been granted consent and revoke that consent.