webMethods Developer Portal trying out an OAuth2 Protected API
Tags: oauth2, api, webmethods, tutorial
Published: 2022-11-03 10:16:21

---
title: webMethods Developer Portal trying out an OAuth2 Protected API
published: true
date: 2022-09-15 11:43:36 UTC
tags: OAuth2, api, webmethods, tutorial
canonical_url: https://tech.forums.softwareag.com/t/webmethods-developer-portal-trying-out-an-oauth2-protected-api/263703
---

## Introduction

In this tutorial you will be learning how to request for OAuth token to try out an OAuth2 protected API from webMethods Developer Portal try out page.

## Pre-requisite

The tutorial assumes that the reader has:

- a basic understanding of API Gateway’s its policy enforcement and webMethods Developer Portal
- a basic knowledge on OAuth 2 authentication framework

In this tutorial the basic details of how to setup OAuth2 authentication server in API Gateway will be covered. But for more details you could refer the following tutorial [OAuth2 in API Gateway](https://tech.forums.softwareag.com/t/securing-apis-using-oauth-2-in-api-gateway/237217)

## Steps to follow

### Step 1: Enable HTTPS port in API Gateway

The OAuth2 token request by default could be invoked via https only. To ensure https port is enabled go to Administration → Security → Ports

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/c/2/c2f46d26c4de1ff492158b28c903b50aec4a7d86_2_690x216.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/c/2/c2f46d26c4de1ff492158b28c903b50aec4a7d86.png "image")

### Step 2: Configuring local authorization server in API Gateway

Go to Administration → Security→ JWT/OAuth/OpenID

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/b/5/b5cfcfdc4b163a5db4af36adc445d3ab4800f2d5_2_690x286.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/b/5/b5cfcfdc4b163a5db4af36adc445d3ab4800f2d5.png "image")

In internal authorization servers, Local authorization server is gateway acting as the authorization server. Click on local. You can see the OAuth configuration, issued OAuth tokens and OAuth scopes.

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/4/b/4b826ed32274c42db900e844c7d1e3e455b99a8b_2_690x326.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/4/b/4b826ed32274c42db900e844c7d1e3e455b99a8b.png "image")

**OAuth scopes:** Scopes are the ways to limit the access to the protected resources. Scopes are generally the business uses(say readonly, write, inventory). You can define your own scopes here. Scope is mandatory to map the API or Resource. So i’ll create a scope call Tracker

### Step 3: Importing an API into API Gateway and Enforcing OAuth 2

Let me import an API to get latest bitcoin price

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/4/a/4aed8985907040f7c30e8b3f94cfc541464b37ec_2_690x326.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/4/a/4aed8985907040f7c30e8b3f94cfc541464b37ec.png "image")

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/b/3/b33ce49e6f6fc72fa3748702f2980aae347f8975_2_690x80.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/b/3/b33ce49e6f6fc72fa3748702f2980aae347f8975.png "image")

Edit an API in API Gateway. Click Edit. Click Identity and Access management. Click Identify and authenticate icon. Tick OAuth2 Token. This procedure will enforce OAuth authorization for this service.

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/5/9/5912c488ddab0c3528abda7964ea44e675a35aa4_2_690x200.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/5/9/5912c488ddab0c3528abda7964ea44e675a35aa4.png "image")

Then Activate an API

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/f/7/f7dfd7f51a5b3ae12f34737e4351524e3a60e1b5_2_690x83.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/f/7/f7dfd7f51a5b3ae12f34737e4351524e3a60e1b5.png "image")

### Step 4: Linking authorization server scopes to the API Scopes

Now the authorization server has scope Tracker. To provide the meaning to the authorization server scopes. Go to OAuth/OpenID scopes under main menu. Click “Map scope”.

Add the Authorization Server scope

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/4/d/4df04c34d8084420850abaea7fc69dc77a38dda0_2_690x210.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/4/d/4df04c34d8084420850abaea7fc69dc77a38dda0.png "image")

Then Add the API

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/7/e/7ed4b018c7f44e46e86339892ef0361218cb1bc6_2_690x137.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/7/e/7ed4b018c7f44e46e86339892ef0361218cb1bc6.png "image")

### Step 5: Registering webMethods Developer Portal in API Gateway

Go to Administration → Destinations → API Portal → Configurations. Provide the webMethods Developer Portal communication details and Publish. Note the OAuth2 token request would work only on top of https connection. So ensure you provided https URL of API Gateway

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/b/9/b9cab9838796217ed72365a8a0c240a1210fd5c2_2_690x309.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/b/9/b9cab9838796217ed72365a8a0c240a1210fd5c2.png "image")

Next publish an API

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/9/2/92fee95216da729cc0f111b147c0c65dc91c420f_2_690x216.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/9/2/92fee95216da729cc0f111b147c0c65dc91c420f.png "image")

### Step 6: Request an Application for an API from webMethods Developer Portal

Login to webMethods Developer Portal. You must be seeing the published API. Click the API. Click consume button to request new application

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/4/6/4604d36d09b91dc0f2bccb46ea98bb997daf6753_2_690x115.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/4/6/4604d36d09b91dc0f2bccb46ea98bb997daf6753.png "image")

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/8/0/80b389cbe5f6faa40b7126cb724ca68c003fb070_2_690x435.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/8/0/80b389cbe5f6faa40b7126cb724ca68c003fb070.png "image")

The request would create an Application in API Gateway and the credentials would be shared to webMethods Developer Portal

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/c/f/cf0c7b337dc9aee5021cbd56f0a29958dec8a248_2_690x389.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/c/f/cf0c7b337dc9aee5021cbd56f0a29958dec8a248.png "image")

### Step 7: Requesting an OAuth token and trying out an API

Now we have an Application, to request OAuth token go to tryout page of an API and select an Application,

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/3/8/38c11f360abf98a4f5638d72a2ecda78b632931f_2_690x222.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/3/8/38c11f360abf98a4f5638d72a2ecda78b632931f.png "image")

Click ‘+’ button. Select the required Grant type and scope. And click Get token

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/1/3/13492f4609b228e660a6dc1d8686cb040378d25c_2_690x292.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/1/3/13492f4609b228e660a6dc1d8686cb040378d25c.png "image")

You will be getting this popup with the services to which you want to give access to

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/a/a/aa9b5985d77b445af6ea3548a5ab1481b9c1179c_2_690x137.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/a/a/aa9b5985d77b445af6ea3548a5ab1481b9c1179c.png "image")

Once its approved the page will be closed automatically and you will be able to view the token in webMethods Developer Portal. Now if you hit the send button you will be able to access the API

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/7/7/77c534c81c95a04058127cae00b175258cdae36a_2_690x345.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/7/7/77c534c81c95a04058127cae00b175258cdae36a.png "image")

[Read full topic](https://tech.forums.softwareag.com/t/webmethods-developer-portal-trying-out-an-oauth2-protected-api/263703)