--- category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend] keyword: Extend nav: wcp_docs parent_url: /wcp_docs/ title: Get a Refresh Token for WCPISU Authentication layout: subsection --- ### Prerequisites - An Integration System User (ISU) user. - API client ID and secret of your custom app. You can get these values by selecting API Clients from the Console section of the Developer Site menu. - An HTTP REST API client tester, such as Postman. - A Base64 encoding scheme. ### Context Note: The `WCPISU` authentication type is a legacy mechanism for authenticating apps with an ISU user. Instead of using `WCPISU`, Workday recommends the simplified `ISU` authentication type, which is an improved and simpler version. Existing apps with Presentation Components can continue using `WCPISU`, but new apps must use `ISU`. Workday strongly recommends that existing apps migrate to `ISU`. To migrate an existing app to `ISU`: 1. Add the `ISU` authentication scheme to `authTypes` in the SMD. 2. Update the PMD endpoint definitions that use `WCPISU`. Replace the `authType` value with the `id` of the ISU scheme declared in the SMD. See [Steps: Set Up ISU Authentication for Apps](/wcp_docs/GUID-3277fec3-24c9-41da-9840-c61b41033f28-enHYPHENus.html). To use the WCPISU authentication scheme in your custom app, you need to get refresh tokens for the ISU and save them in the credential store. Presentation Components retrieve the refresh token from the credential store and use it to authenticate a client request. Note: Your account region determines the base URL of the authorization endpoints. See [Reference: Workday Extend API Gateways and Authorization Base URLs](/wcp_docs/dlh1653340161856.html). Use the appropriate base URL in these authorization endpoints: ``` https://{regionAuthBaseUrl}/v1/authorize https://{regionAuthBaseUrl}/v1/token ``` ### Steps 1. Sign in your tenant as the ISU user. Note: Selecting the Do Not Allow UI Sessions option on the Edit Workday Accounts task prevents the ISU user from signing in to the Workday UI. You can clear the option before you store tokens in the CredStore, and select the option again afterwards. 2. On a browser, enter this URL: `https://{regionAuthBaseUrl}/v1/authorize?response_type=code&client_id={clientId}&redirect_uri={redirectUri}`.
Option Description
response_typeSet this value to code for the Authorization Code grant type.
client_idThe Client ID of your custom app.
redirectUriThe Redirect URI of your custom app.

3. When prompted, enter your tenant alias. 4. After you sign in, the browser URL displays your redirect URI with a code. Save the code value on your clipboard. You'll use this code when you invoke the `/token` endpoint in the next step. Example: ``` http://localhost:8123/?code=59a0c0a2-8b9a-47e6-a509-0a79f4e4c46a ``` The access `code` returned by the `/authorize` endpoint expires in 10 minutes. 5. On an HTTP REST API client testing tool such as Postman or SOAP UI, submit this HTTP request: `https://{regionAuthBaseUrl}/v1/token`
HTTP MethodPOST
HTTP Endpointhttps://{regionAuthBaseUrl}/v1/token
Headers

Content-Type: application/x-www-form-urlencoded

Authorization: Basic {base64-encoded-clientIdAndSecret}

Where {base64-encoded-clientIdAndSecret} is the base64 encoded value of {clientId}:{clientSecret}.

To get the {base64-encoded-clientIdAndSecret} value:

  • Get the Client ID and Client Secret from the Console.
  • Concatenate the client ID and secret using a colon (:). Example: Y2YyYmY2MWYtNDU4N:ad3mrxa0lhxai3xo7d2uz9ar
  • Encode the concatenated value in Base64.
Body parameters

grant_type: Set this value to authorization_code.

code: Enter the Authorization code that you saved from the /authorize endpoint in the previous step.

Note: If you're using Postman, make sure that you select x-www-form-urlencoded when you enter the Body parameters.

6. After you submit the request, the `/token` endpoint returns the `refresh_token` in the response data. Copy the `refresh_token` value to your clipboard. You'll use this refresh token on the Refresh Tokens grid on Create External Client CredStore task. The `refresh_token` returned by the `/token` endpoint doesn't expire. ### Next Steps [Create External Client CredStore](/wcp_docs/gqs1527493104452.html#).