Configure API clients for OAuth

Applications that access the Medallia Experience Cloud APIs use a client secret when authorizing with OAuth. A client secret is a pre-authenticated identification that together with the Client ID identifies the app and grants access to the appropriate resources.

Client applications not representing a user have a clientSecret identification that is pre-authenticated and hard-coded into the app.

Applications accessing the APIs need:

  • Client ID — Identifies the client configuration on the Clients screen.

  • Client Secret — Created with the client configuration.

  • OAuth Token Endpoint — Issues access tokens for the company instance. The endpoint is shown on the Configuration screen.

Note: For information about how applications use the credentials to access the APIs, see Authenticate APIs with OAuth.

Create an API client

Follow these steps to create an OAuth client for an application that needs access to the APIs.

  1. On the AppID Accounts screen, create an service account to use as the Subject for the OAuth client. The service account determines the data the client may access:

    1. Click New to create a service account.

    2. Provide a name that is unique to both the AppID Accounts and to all Users.

    3. For Account Type, choose Custom.

    4. Enable the account.

    5. Choose the User Group (Role) that determines the data this account may access.

    6. Choose the Default access that determines the units the account may access. The default is all units. You can change the selection after saving the new account.

    7. Click Save.

  2. On the Clients screen:

    1. Name the client in the Client ID.

      Important: Make note of the Client ID to provide to the client.

    2. Create the Client Secret code.

      1. Click Change password.

      2. Either enter a secret string, or click Suggest and pick one of the suggested strings.

      Important: Make a note of the client-secret string. Once you save this configuration, you are never able to see it again. If you lose the Client secret, you have to create a new one and provide that to the client.

    3. Turn on Confidential.

    4. For the Grants type, select Client Credentials Grant.

    5. For the Client subject, choose the AppID you created above.

    6. Optionally, override the default timeout for the access token.

      1. Turn on Override default token timeouts.

      2. Click Save.

      3. Change the duration of the Access token lifetime property.

    7. Click Save.

  3. On the Configuration screen, make note of the Oauth Token endpoint URL

  4. Provide authorization credentials to the client:

    • Client ID

    • Client Secret

    • OAuth Token Endpoint

The client can now use the credentials to access the APIs.