availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Configure OAuth 2.0 authentication

Configure OAuth 2.0 authentication on a target so Invicti Platform can scan web applications that require OAuth 2.0 to access protected areas. This document explains the supported grant types, the full configuration steps, and how to use stored secrets instead of entering credentials directly.

Why this matters

OAuth 2.0 is widely used to protect modern web applications. Without it configured, Invicti only scans publicly accessible pages and misses vulnerabilities in areas that require a valid access token. Configuring OAuth 2.0 lets scans reach those protected endpoints and give you complete coverage of your application.

How to set up OAuth 2.0 authentication

1. Select Inventory > Targets from the left-side menu.

2. Select the target you want to configure and click Edit target.

3. Select Authentication from the target settings sidebar.

4. Set Authentication method to OAuth 2.0.

5. Set the Grant type to the OAuth 2.0 flow your application uses:

   • If you select Password Credentials, also set the Username and Password fields for the account Invicti should authenticate as.

Grant type	When to use
Authorization Code	The authorization server issues a code after user login; the app exchanges it for a token. Most secure and widely supported.
Implicit	The access token is returned directly after user authorization. Used by some older single-page applications.
Client Credentials	The app authenticates with its own credentials, with no user involved. Used for machine-to-machine (M2M) flows.
Password Credentials	The user's username and password are sent directly to the authorization server. Use only for trusted, internal applications.

6. Set the Access token URL - the endpoint your authorization server uses to issue tokens.
7. Set the Client ID and Client secret - the credentials your application was assigned when registered with the authorization server.
8. Set the Scope field (optional) to a space-delimited list of permissions to request with the token.
9. Select Save target configuration or Scan to confirm.

note

For the Authorization Code and Implicit grant types, a 3-legged sequence option is available after you save. Save the configuration first, then proceed with 3-legged sequence setup.

Use secrets for OAuth credentials

Secrets must be configured in Invicti Platform or sourced from a connected vault before you can reference them in OAuth fields. For setup instructions, refer to Using secrets in scans.

Instead of entering credentials directly, you can reference a stored secret for the Access token URL, Client ID, Client secret, Scope, Username, and Password fields. Invicti Platform resolves the secret at scan time and never stores the actual credential value in the target configuration.

To use a secret:

1. Click the key icon next to the credential field.
2. Select the secret from the list. The field shows the secret name in {{secretName}} format.
3. Select Save target configuration to confirm.

Troubleshooting

The key icon shows a validation error after I select a secret

This happens when the selected secret name no longer exists in the secrets store - for example, if the secret was deleted after the target was last saved. Click the key icon again and select a valid secret, or enter the credential value directly.

The scan fails to authenticate even though OAuth 2.0 is configured

Check the following:

• The Grant type matches what your authorization server requires.
• The Access token URL is reachable from the scanning agent. For internal targets, confirm your internal agent has network access to the authorization server.
• The Client ID and Client secret are valid and haven't been rotated. If you're using secret references, verify the secret value is current in Scans > Secrets.
• If the grant type is Password Credentials, confirm the Username and Password are correct and the account isn't locked or expired.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center