Flow.Documentation
ProfessionalAPIs

Sign in with OAuth 2.0 (client credentials)

6 steps± 4 minVideoVerified 22 Oct 2026
  1. Step 1 · Open your development environment
  2. Step 2 · A policy with OAuth 2.0 and a required permission
  3. Step 3 · Attach the policy to the API
  4. Step 4 · Create an OAuth client
  5. Step 5 · Call the API with the token
  6. Step 6 · See who called

Applications that talk to each other often sign in with OAuth 2.0 client credentials: with a client_id and client_secret they fetch a short-lived token (one hour) from the token endpoint, and send it along as a bearer token. Flow's gateway is that token issuer itself. You create a policy with OAuth 2.0 and a required permission, a client with that permission, fetch a token and call the API with it.

Watch the whole guide as a video6 steps in one film
Step 1 / 6

Open your development environment

In the portal, under Environments, click Development, and there Open. Flow opens in a new tab and you are signed in straight away.

  1. Click Development
Open your development environment · Click Development
  1. Click Open ↗
Open your development environment · Click Open ↗
Step 2 / 6

A policy with OAuth 2.0 and a required permission

Under Security you create a policy: API key off, OAuth 2.0 on, and under Required scopes the permission every consumer must have.

  1. Click Security
A policy with OAuth 2.0 and a required permission · Click Security
  1. Click New security policy
A policy with OAuth 2.0 and a required permission · Click New security policy
  1. In Name, type Planning systems (OAuth)
A policy with OAuth 2.0 and a required permission · In Name, type Planning systems (OAuth)
  1. Click API key X-API-Key or Bearer flw_…
A policy with OAuth 2.0 and a required permission · Click API key X-API-Key or Bearer flw_…
  1. Click OAuth 2.0 Client credentials; JWT tokens from this gateway
A policy with OAuth 2.0 and a required permission · Click OAuth 2.0 Client credentials; JWT tokens from this gateway
  1. In Required scopes, type rides:read
A policy with OAuth 2.0 and a required permission · In Required scopes, type rides:read
  1. Click Save policy
A policy with OAuth 2.0 and a required permission · Click Save policy
A policy with OAuth 2.0 and a required permission · In with OAuth 2.0, and only with the permission rides:read.
Step 3 / 6

Attach the policy to the API

Open the API, choose the policy and save.

  1. Click Explorer
Attach the policy to the API · Click Explorer
  1. Click the API
Attach the policy to the API · Click the API
  1. In Security policy, choose Planning systems (OAuth)
Attach the policy to the API · In Security policy, choose Planning systems (OAuth)
  1. Click Save API
Attach the policy to the API · Click Save API
Attach the policy to the API · In plain language: OAuth 2.0 and the permission rides:read.
Step 4 / 6

Create an OAuth client

Under Security → OAuth clients you give the application a name and the permissions it gets. You see once the client_id, the client_secret and the address of the token endpoint: hand them to the application's administrator.

  1. Click Security
Create an OAuth client · Click Security
  1. Click OAuth clients
Create an OAuth client · Click OAuth clients
  1. In Name, type Route planner
  2. In Scopes, type rides:read
Create an OAuth client · In Name, type Route planner; In Scopes, type rides:read
  1. Click Create OAuth client
Create an OAuth client · Click Create OAuth client
Create an OAuth client · client_id, client_secret (covered up) and the token endpoint.
  1. Click I have stored it
Create an OAuth client · Click I have stored it
Step 5 / 6

Call the API with the token

The application sends grant_type=client_credentials with its client_id and client_secret to the token endpoint and gets a token that is valid for one hour. That token goes along as a Bearer token. In Test APIs you do the same: choose Bearer token and paste the token.

  1. Click Test APIs
Call the API with the token · Click Test APIs
  1. Click the endpoint
Call the API with the token · Click the endpoint
  1. Click Bearer token
Call the API with the token · Click Bearer token
  1. In Key or token, type ••••••••
Call the API with the token · In Key or token, type ••••••••
  1. Click ▶ Send
Call the API with the token · Click ▶ Send
Call the API with the token · 200: token valid, permission present.
Call the API with the token · The API's answer.
Step 6 / 6

See who called

Live traffic shows the call with the method oauth2 and the application's client_id. If you revoke the client, even a token that was still valid stops working.

  1. Click Runs
See who called · Click Runs
  1. Click Live traffic
See who called · Click Live traffic
See who called · The call: 200, signed in with oauth2, with the client_id.

This guide was carried out step by step on 22 Oct 2026 by an automated test on Flow (version 3e563176).