---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, Presentation Components, Endpoint authentication, UI components]
nav: wcp_docs
parent_url: /wcp_docs/
title: Create External Client CredStore
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
-   Security: <i>Security Administration</i> domain in the System functional area.
-   If you're using the legacy Workday Cloud Platform Integration System User (`WCPISU`) authentication type, [Get a Refresh Token for WCPISU Authentication](/wcp_docs/bby1527491420006.html).

    <b>Note:</b> The `WCPISU` authentication type is a legacy mechanism for authenticating apps with an ISU user. Instead of using `WCPISU`, Workday recommends the simplified `ISU` authentication type, which is an improved and simpler version. Existing apps with Presentation Components can continue using `WCPISU`, but new apps must use `ISU`. Workday strongly recommends that existing apps migrate to `ISU`. See [Steps: Set Up ISU Authentication for Apps](/wcp_docs/GUID-3277fec3-24c9-41da-9840-c61b41033f28-enHYPHENus.html).



### Context

<a id="context_N10027_N1001E_N10001"></a>
The <b>Create External Client CredStore</b> task enables external apps and orchestrations to store OAuth2 access and refresh tokens in the Workday credential store.

For endpoint authentication with Presentation Components, use <b>Create External Client CredStore</b> for these authentication types:

<table><thead><tr><th>Authentication Type</th><th>Stored Credentials</th><th>Related Information</th></tr></thead><tbody><tr><td><code>OAUTH_CLIENT_CREDENTIAL</code></td><td>Client credentials from the third-party REST service using the OAuth2 client credentials grant type.</td><td><a href="/wcp_docs/axp1537909839739.html">Reference: OAuth2 Client Credentials</a></td></tr><tr><td><code>OAUTH2</code></td><td>Client credentials from the third-party REST service using the OAuth2 authorization code grant type</td><td><a href="/wcp_docs/jzx1537909761291.html">Reference: OAuth2 Authorization Code</a></td></tr><tr><td><code>WCPISU</code> (Legacy)</td><td>ISU refresh tokens.</td><td><a href="/wcp_docs/rzc1537922580355.html">Reference: Workday Integration System User (Legacy WCPISU)</a></td></tr></tbody></table><br/>

<b>Note:</b> Your account region determines the base URL of the authorization endpoints. See [Reference: Workday Extend API Gateways and Authorization Base URLs](/wcp_docs/dlh1653340161856.html). Use the appropriate base URL in these authorization endpoints:

```
https://{regionAuthBaseUrl}/v1/authorize
https://{regionAuthBaseUrl}/v1/token
```

### Steps

1.  <a id="step_N10057_N10032_N1001E_N10001"></a>Access the <b>Create External Client CredStore</b> task.

    <b>Note:</b> Selecting the <b>Do Not Allow UI Sessions</b> option on the <b>Edit Workday Accounts</b> task prevents the ISU user from signing in to the Workday UI. You can clear the option before you store tokens in the CredStore, and select the option again afterwards.

2.  <a id="step_N10064_N10032_N1001E_N10001"></a>Enter this information:

<table><thead><tr><th>    Option</th><th>    Description</th></tr></thead><tbody><tr><td><b>App ID</b></td><td>The unique reference ID of your app. <p>Specify the reference ID with the postfixed account ID. You can find the reference ID of your app on <b>App Manager</b> or in the AMD.</p> <p>For orchestrations, specify the reference ID of the app that launches the orchestration.</p></td></tr><tr><td><b>External Reference ID</b></td><td><ul><li>    For <code>OAUTH_CLIENT_CREDENTIAL</code> and <code>OAUTH2</code>, set the External Reference ID to a unique value, which matches the authType <code>referenceId</code> in the SMD.
</li><li>    For legacy <code>WCPISU</code>, enter the same value you use for <b>App ID</b>.
</li></ul></td></tr><tr><td><b>Client ID</b></td><td>The client ID of your app. <ul><li>    For <code>OAUTH_CLIENT_CREDENTIAL</code> and <code>OAUTH2</code>, enter the value from the third-party REST service authentication registry.
</li><li>    For legacy <code>WCPISU</code>, enter the value from the list of API Clients on the Developer Site.
</li></ul></td></tr><tr><td><b>Client Secret</b></td><td>The client secret of your app. <ul><li>    For <code>OAUTH_CLIENT_CREDENTIAL</code> and <code>OAUTH2</code>, enter the value from the third-party REST service authentication registry.
</li><li>    For legacy <code>WCPISU</code>, enter the value from the Developer Site.
</li></ul></td></tr><tr><td><b>Tokens</b></td><td>(For legacy <code>WCPISU</code> only). The OAuth2 access or refresh tokens. <p>Use the grid to add an ISU refresh token for your app:</p> <ul><li>    <b>Token</b>: An OAuth2 WCP refresh token. A client request will initially authenticate using this stored refresh token.
</li></ul> <ul><li>    <b>Token Holder</b>: The ISU username.
</li><li>    <b>Descriptor</b>: Valid values are <code>AccessToken</code> and <code>RefreshToken</code>. For the WCPISU authentication scheme, set the <b>Descriptor</b> to <code>RefreshToken</code>.
</li><li>    <b>Expiration Time</b>: (Optional) The token expiration date and time.
</li><li>    <b>Used for Environments</b>: The environments that the refresh token applies to. By default, the refresh token applies to all tenant environments. If you specify environments, the WCPISU authentication scheme uses the refresh token only for the specified environments. You must also set the <code>checkEnvironment</code> attribute to <code>true</code> in the <code>WCPISU</code> authType entry in the SMD.

<p><b>Note:</b> For <b>Sandbox</b> and <b>Sandbox Preview</b> tenants: Create separate refresh tokens on the Sandbox and Sandbox Preview tenants. If you haven't set up refresh tokens in the Sandbox Preview tenant where you've created business objects, you'll encounter HTTP 500 errors when attempting to access those business objects on Sandbox Preview. If you've only set up refresh tokens in the Sandbox tenant, you can only access the business objects in the Sandbox tenant.</p></li></ul></td></tr><tr><td><b>Authorization Endpoint</b></td><td><ul><li>    For <code>OAUTH2</code>, specify the OAuth2 authorization endpoint from the third-party REST service.
</li><li>    For legacy <code>WCPISU</code>, specify <code>https://{regionAuthBaseUrl}/v1/authorize</code>
</li></ul></td></tr><tr><td><b>Token Endpoint</b></td><td><ul><li>    For <code>OAUTH_CLIENT_CREDENTIAL</code> and <code>OAUTH2</code>, enter the OAuth2 token endpoint from the third-party REST service.
</li><li>    For legacy <code>WCPISU</code>, specify <code>https://{regionAuthBaseUrl}/v1/token</code>
</li></ul></td></tr><tr><td><b>Revoke Endpoint</b></td><td>You can leave this blank.</td></tr><tr><td><b>Scope</b></td><td><ul><li>    For <code>OAUTH_CLIENT_CREDENTIAL</code> and <code>OAUTH2</code>, enter any scope required by the third-party REST service authentication.
</li><li>    For legacy <code>WCPISU</code>, you can leave this blank.
</li></ul></td></tr><tr><td><b>Auth Scheme for External Client</b></td><td><ul><li>    For <code>OAUTH_CLIENT_CREDENTIAL</code>, select <b>OAuth 2.0 Client Credential</b>.
</li><li>    For <code>OAUTH2</code> and <code>WCPISU</code>, select <b>OAuth 2.0 Authorization Code</b>.
</li></ul></td></tr></tbody></table><br/>



### Next Steps

<a id="postreq_N1009E_N1001E_N10001"></a>
For Presentation Components, update the SMD and PMDs using these guidelines:

<table><thead><tr><th>Authentication Type</th><th>Update the SMD:</th><th>Update PMDs:</th></tr></thead><tbody><tr><td><code>OAUTH_CLIENT_CREDENTIAL</code></td><td><ul><li>Add <code>"scheme": "OAUTH_CLIENT_CREDENTIAL"</code> to <code>authTypes[]</code>.
</li><li>Set the <code>referenceId</code> attribute to the value of the <b>External Reference ID</b> in the credential store.
</li><li>Specify <code>"source": "CREDSTORE"</code>.
</li></ul></td><td>For each PMD endpoint requiring <code>OAUTH_CLIENT_CREDENTIAL</code> authentication, set its <code>authType</code> to the <code>id</code> of the <code>OAUTH_CLIENT_CREDENTIAL</code> scheme in the SMD.</td></tr><tr><td><code>OAUTH2</code></td><td><ul><li>Add <code>"scheme": "OAUTH2"</code> to <code>authTypes[]</code>.
</li><li>Set the <code>referenceId</code> attribute to the value of the <b>External Reference ID</b> in the credential store.
</li><li>Specify <code>"source": "CREDSTORE"</code>.
</li></ul></td><td>For each PMD endpoint requiring <code>OAUTH2</code> authentication, set its <code>authType</code> to the <code>id</code> of the <code>OAUTH2</code> authentication scheme in the SMD.</td></tr><tr><td>Legacy <code>WCPISU</code></td><td><ul><li>Add <code>"scheme": "WCPISU"</code> to <code>authTypes[]</code>.
</li><li>Set the <code>appId</code> attribute to the value of <b>App Id</b> in the credential store.
</li><li>Set the <code>tokenHolder</code> attribute to the value of <b>Token Holder</b> in the credential store.
</li><li>Set the <code>checkEnvironment</code> attribute to <code>true</code> if you specified environments on <b>Used for Environments</b> in the credential store tokens.
</li></ul></td><td>For each PMD endpoint requiring <code>WCPISU</code> authentication, set its <code>authType</code> to the <code>id</code> of the WCPISU scheme in the SMD.</td></tr></tbody></table><br/>