# advice on implementing OAuth 2.0 using the client credentials flow in pega 7.3.1 **URL:** \ **Category:** General\ **Tags:** government, 7-3-1, next-best-action-analyst, app-studio, security\ **Created:** [February 9, 2022, 5:26pm UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195 "2022-02-09T17:26:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![matthewk2081](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@matthewk2081](https://forums.pega.com/u/matthewk2081)\ **Post date:** [February 9, 2022, 5:26pm UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/1 "2022-02-09T17:26:08Z")
I have a requirement to access an external web service from pega 7.3.1 using OAuth 2.0 with the client credentials flow. Anyone have any experience of this would like to share best practice? I can see that later versions of pega allow more configuration when creating an authentication profile ie the connection to the token provider ---
**Author:** ![matthewk2081](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@matthewk2081](https://forums.pega.com/u/matthewk2081)\ **Post date:** [February 24, 2022, 12:24pm UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/2 "2022-02-24T12:24:59Z")
@matthewk2081 ok so I have made some progress on this - the last challenge - hopefully is configuring the O Auth 2.0 Authentication profile. I was hoping to be able to populate the secret value using Global Resources Settings but it appears that field doesnt support that syntax [Pegasystems Documentation](https://docs-previous.pega.com/data-management-and-integration/85/fields-support-global-resource-settings-syntax#Fields_that_support_the_Global_Resource_Settings_syntax). What is an alternative way if hard coding the value is not an option? ![oath 2.png](https://pega1.discourse-cdn.com/pega/original/2X/6/6ff9e56d4fe260ef037403b3c94f57060417e575.png) ---
**Author:** ![RobertS16860954](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@RobertS16860954](https://forums.pega.com/u/RobertS16860954)\ **Post date:** [June 8, 2022, 2:45pm UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/3 "2022-06-08T14:45:08Z")
@matthewk2081 I am researching how to dynamically pass in the client secret, as we don’t want devs to maintain/access the key. Have you found a way to use GRS or other dynamic approach? ---
**Author:** ![matthewk2081](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@matthewk2081](https://forums.pega.com/u/matthewk2081)\ **Post date:** [June 16, 2022, 8:12am UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/4 "2022-06-16T08:12:05Z")
@robs1550 Nope, I raised an SR with Pega and am yet to receive a response ---
**Author:** ![MarijeSchillern](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/marijeschillern/32/23321_2.png) [@MarijeSchillern](https://forums.pega.com/u/MarijeSchillern)\ **Post date:** [June 16, 2022, 10:25am UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/5 "2022-06-16T10:25:22Z")
Hello @matthewk2081. I checked to try to find the SR you reference. Is it the one you logged on 28 February? SR-113418/ INC-213581 (security issue in O Auth 2.0 authentication profile) I have checked the investigation that was carried out: On March 7th the support engineer informed you that this is an enhancement request **FDBK-86037** was created on your behalf, and this information was passed back to you, which you acknowledged. Details of the enhancement request for our engineering team to consider for a future version: “_Request is for the client secret field for an OAuth 2.0 Authentication profile to support Global Resources settings (ref: [Pegasystems Documentation](https://docs-previous.pega.com/data-management-and-integration/85/configuring-dynamic-references-external-systems-using-global-resource-settings-feature)) or a suitable workaround. Currently the client secret would have to be hard coded which from a security standpoint is unacceptable is preventing us from using this functionalit_y.” Therefore I believe we have answered your question. Feel free to follow up the FDBK with your Pega AE if required. I have linked it to this forum question for visibility. ---
**Author:** ![DebashisHere](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/debashishere/32/4792_2.png) [@DebashisHere](https://forums.pega.com/u/DebashisHere)\ **Post date:** [February 17, 2023, 5:20pm UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/6 "2023-02-17T17:20:31Z")
@MarijeSchillern Looks like this is not present in Pega v8.8, when this will be taking care? ---
**Author:** ![MarijeSchillern](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/marijeschillern/32/23321_2.png) [@MarijeSchillern](https://forums.pega.com/u/MarijeSchillern)\ **Post date:** [February 20, 2023, 10:26am UTC](https://forums.pega.com/t/advice-on-implementing-oauth-2-0-using-the-client-credentials-flow-in-pega-7-3-1/2195/7 "2023-02-20T10:26:02Z")
@DebashisHere please follow up with your AE about any existing Enhancement Requests.