OAuth Settings Tab of the Custom Menu Item Dialog Box

Field and Button

Description

Name

Use this field to specify the name of the custom menu item.

OAuth Flow

Use this field to specify the OAuth mechanism type.

OAuth mechanism types or grant types define different ways to obtain access tokens, each suited for specific use cases.

Your options are:

• None: Select this option if you prefer not to specify the OAuth mechanism type.

• Auth Code: This type is typically used by server-side applications. It involves the client obtaining an authorization code from the authorization server, which is then exchanged for an access token. This flow ensures that the client never directly handles the user's credentials.

• Auth Code w/ PKCE: The Authorization Code with Proof Key for Code Exchange (PKCE) type is an extension to the authorization code flow to prevent CSRF and authorization code injection attacks. The technique involves the client first creating a secret on each authorization request and then using that secret again when exchanging the authorization code for an access token. This way, if the code is intercepted, it will not be useful since the token request relies on the initial secret.

For more information, see Protecting Apps with PKCE.

• Client Credentials: This type is used for machine-to-machine communication, where the client uses its own credentials to obtain an access token.

This field defaults to None.

Client ID

Use this field to specify the ID of the client for the OAuth server.

This field is required.

Client Secret

Use this field to specify the character string of the client secret manually obtained from the server.

This field is required.

Auth URL

Use this field to specify the endpoint where the user is redirected to grant permissions.

This field is required. This field is disabled when you select Client Credentials in the OAuth Flow field.

Access Token URL

Use this field to specify the endpoint used in the OAuth authorization process where a client application exchanges an authorization code for an access token.

This field is required.

Callback URL

Use this field to specify an endpoint on your server or application that an external system uses to notify you when it has completed processing a request.

This field is required. This field is disabled when you select Client Credentials in the OAuth Flow field.

Scopes

Use this field to specify the specific permissions an application can request from a user.

This field is required.

Test OAuth

Click this button to test the OAuth configuration by sending the authentication settings to the OAuth provider and verifying that it authenticates and returns a token.