# Custom Bearer Grant Type

**URL:** <https://forums.pega.com/t/custom-bearer-grant-type/10281>\
**Category:** Knowledge Share\
**Created:** [November 27, 2025, 12:00pm UTC](https://forums.pega.com/t/custom-bearer-grant-type/10281 "2025-11-27T12:00:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![KamilJaneczek](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/kamiljaneczek/32/19116_2.png) [@KamilJaneczek](https://forums.pega.com/u/KamilJaneczek)\
**Post date:** [November 27, 2025, 12:00pm UTC](https://forums.pega.com/t/custom-bearer-grant-type/10281/1 "2025-11-27T12:00:47Z")

</div>

Thank you @VinodSeraphin for putting this document together.

See more: [Constellation 101](https://community.pega.com/conversations/user-experience/constellation-101)

If you’ve been building Constellation applications using Web Embed or SDKs, you’ve likely encountered the challenge of managing OAuth 2.0 authentication flows. Traditionally, the “Authorization Code Grant Flow” has been the go-to for public client flows. However, it relies heavily on browser redirects or popups to an external Identity Provider (IDP). While standard you might want to try different approach.

 ![cb.png](https://pega1.discourse-cdn.com/pega/original/2X/e/ea30fcee5185a9958bb2c08cd6b50dd9e405bc53.png)

## Custom Bearer Grant Type

The Custom Bearer Grant Type evolves the authentication process by allowing the client to negotiate a Pega Infinity access token directly via a custom activity. This eliminates the need for intermediate server (that is typically needed to negotiate token with Infinity) or disruptive client-side redirects (as it is present in code auth flow).

Key Benefits:

- Seamless UX: No visible redirects or popups for the end-user.
- Simplified Architecture: Removes the need for a separate “token-negotiating” server.
- Flexibility: You define the authentication logic within a Pega Activity.

### How to Enable It

To start using this feature, you need to enable it via a Dynamic System Setting (DSS):

1. Create/Update DSS: CustomAuthForPegaEmbed
2. Owning Ruleset: Pega-Engine
3. Value: true

Once enabled, you will see the “Custom bearer” checkbox in your OAuth 2.0 Client Registration records.

### Configuration

Please read attached documentation in PDF. High level configuration steps:

1. Configure Authentication Activity
2. Client Integration (Web Embed or SDKs)

### Important Considerations

While powerful, remember that “Custom Bearer” is not a standard OAuth 2.0 grant flow.

- It places the responsibility of authentication logic entirely on your custom activity.
- It does not offer “out-of-the-box” integration with external IDPs (like SAML or OIDC) in the way standard flows do; you must implement any necessary server-to-server validation within your activity.
- Tokens returned are standard Infinity JWTs.

[Custom Bearer Grant Type.pdf](https://forums.pega.com/uploads/short-url/865IaepRkV96mPtLKvwKuKAcD7H.pdf) (563 KB)

---

<div class="post-metadata">

**Author:** ![Arunkumar\_Velmurugan](https://avatars.discourse-cdn.com/v4/letter/a/50afbb/32.png) [@Arunkumar\_Velmurugan](https://forums.pega.com/u/Arunkumar_Velmurugan)\
**Post date:** [December 11, 2025, 10:39pm UTC](https://forums.pega.com/t/custom-bearer-grant-type/10281/2 "2025-12-11T22:39:42Z")

</div>

@Kamil Janeczek I would love to try this feature.