---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, Presentation Components, Endpoint authentication, UI components]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Reference: OAuth2 Authorization Code
layout: subsection
---

<a id="section_oAuth2"></a>
Use the `OAUTH2` authentication scheme for REST API endpoints that require OAuth2 authorization code grant type.

To use the `OAUTH2` authentication scheme, you must:

-   Register your custom app with the third-party REST service provider to get an OAuth2 client ID from them.
-   Store the third-party credentials in the Workday credential store using the <b>Create External Client CredStore</b> task on Workday.
-   Use the [oauthButton](/wcp_docs/ahr1529942847324.html) or [oAuthLoginButton](/wcp_docs/qxm1530914141081.html) tag to prompt the users for their credentials and invoke the external OAuth2 authentication provider.


## <a id="section_mhn_zxv_sfb"></a>SMD authType Attributes

<table><thead><tr><th>Attribute</th><th>Value</th></tr></thead><tbody><tr><td>id</td><td>A unique ID. Use this <code>id</code> in your PMDs to reference this authentication scheme.</td></tr><tr><td>scheme</td><td><code>OAUTH2</code> (case-sensitive)</td></tr><tr><td>source</td><td>Valid values: <ul><li><code>CREDSTORE</code> - The recommended option for storing third-party OAUTH2 credentials in the Workday credential store.
</li><li><code>OMS</code> - The legacy option for storing third-party OAUTH2 credentials in the Workday credential store.
</li></ul></td></tr><tr><td>referenceId</td><td><ul><li>If <code>source</code> is <code>CREDSTORE</code>, use the same External Reference ID defined on the <b>Create External Client CredStore</b> task on Workday.
</li><li>If <code>source</code> is <code>OMS</code>, use the same client ID defined on the <b>Register External OAuth Client</b> task on Workday.
</li></ul></td></tr><tr><td>useProxyServer</td><td>Set to true if you need to register callback URL from the third-party authentication server. Default is false.</td></tr><tr><td>providerType</td><td>Specifies how to send the request. Default is <code>BASIC_AUTH</code>. Valid values: <ul><li><code>STANDARD_POST</code> - Uses HTTP POST method to send the authentication request.
</li><li><code>BASIC_AUTH</code> - Uses the <b>Authorization</b> request header whose value is <code>Basic base64-encoded({client_id}:{client_secret})</code>.
</li></ul></td></tr></tbody></table><br/>

## <a id="section_qkt_1yv_sfb"></a>Example

```
  "siteAuth" : {
    "authTypes" : [ 
      {
        "descriptor": "OAuth2 Acme REST Service",
        "id": "oAuth2Acme",
        "scheme": "OAUTH2",
        "source": "CREDSTORE",
        "referenceId": "acmeOauth2Id",
        "providerType":"STANDARD_POST",
        "useProxyServer " : true
      },
      {
        "id" : "sso",
        "scheme" : "SSO"
      }
    ]
  }
```

<b>Note:</b> The default authentication type is always SSO. To override SSO with the `OAUTH2` authentication type, specify its `id` in the `authType` attribute of the endpoint in the PMD.

### Related Information

[Declare Authentication Types in the SMD](/wcp_docs/nyw1530545468565.html)

[Define Endpoint Authentication in the PMD](/wcp_docs/yea1530546235609.html)

[Reference: Tenant Redirect URLs for External OAuth Providers](/wcp_docs/cpx1566499453357.html)