---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, OAuth]
nav: wcp_docs
parent_url: /wcp_docs/
title: Authenticate Using the Client Credentials Grant Type
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
[Register your API Client](/wcp_docs/zwx1518028675482.html) on the Workday Developer Site.

Security: <i>Integration Security</i> domain in the Integration functional area and <i>Security Administration</i> domain in the System functional area.

### Context

<a id="context_N10027_N1001E_N10001"></a>
The Client Credentials Grant Type is an OAuth2 Grant Type in which the app sends its own credentials (the Client ID and the Client Secret) to authenticate with. If a Client Credentials request to the token endpoint with a valid Client ID and Client Secret is successfully validated:

-   The Workday Extend Authentication and Authorization Service retrieves an access token from the tenant and returns it to the client.
-   The Integration System User is the subject of the access token.


This authorization flow enables service-to-service apps on Workday Extend, such as Studio integrations, to retrieve data from a Workday tenant using an Integration System User account.

### Steps

1.  <a id="step_N10050_N1004D_N1001F_N10001"></a>Create the Integration System User and configure the client credentials mapping in Workday.

    1.  Access the <b>Create Integration System User</b> task and fill out the required fields.
    2.  Access the <b>Create Client Credentials Mapping</b> task.
    3.  Enter the <b>Client ID</b> of the API Client.
    4.  Select the <b>Integration System User</b> you created from the prompt.

    To access Workday resources:

    -   You must enable the appropriate Scope for the endpoint on the API Client.
    -   The Workday user must have access to the domain security policies that govern the operation.

2.  <a id="step_N100B6_N1003B_N1001E_N10001"></a>Create a POST request to call the token endpoint.
3.  <a id="step_N100C7_N1003B_N1001E_N10001"></a>Obtain the Client ID of the API Client from the Console on the Workday Developer Site. You also need the client secret generated when you registered your API Client. If you lost your client secret, you can generate a new client secret from the Console. These values enable you to provide the proper headers to call the endpoint.
4.  <a id="step_N100D8_N1003B_N1001E_N10001"></a>Encode these values into Base64 format. Use the format `[Client ID]:[Client Secret]`. Do not add a space after the colon.
5.  <a id="step_N100F0_N1003B_N1001E_N10001"></a>Build the Authorization header and body.
    1.  Populate the header of the request with `ID [Encoded Value]`. You must add a space after ID.
    2.  Populate the body of the request with the `grant_type` and `tenant_alias` keys and the appropriate values, such as `client_credentials` and `myTenantAlias`. Use the <i>x-www-form-urlencoded</i> option to specify that the values will be encoded inside the URL itself. This adds a new header to specify the content-type.

6.  <a id="step_N10133_N1003B_N1001E_N10001"></a>Click <b>Send</b> to retrieve the access token from the tenant.


### Result

<a id="result_N10138_N1001E_N10001"></a>
You can now access Workday Extend REST API resources from service-to-service apps, such as Studio integrations, using an Integration System User account.

### Related Information

[Base64 Encoding and Decoding](https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding)