> For the complete documentation index, see [llms.txt](https://community-test.logicnets.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://community-test.logicnets.com/release-9/platform-documentation/advanced-topics/webservice-api/how-to-use-the-oauth-2-0-client-credentials-flow-using-rs256-signed-jwt-bearer.md).

# How to Use the OAuth 2.0 Client Credentials Flow Using RS256-signed JWT Bearer

This topic discusses server-to-server access, where a system calls a LogicNets web API with its own identity. For an application that acts on behalf of a logged-in user, for example an MCP client, use the authorization code flow instead. See [LogicNets as OpenID Provider](/release-9/platform-documentation/advanced-topics/webservice-api/logicnets-as-openid-provider-oauth-2-0-openid-connect.md) for more information.

## Create a WebService API

1. In your Designer, create a new project using the Standard WebService Framework.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-6ece64fc775bc55fe8b7f63276ab7643f676067a%2Ff1ec6290-ffbd-4bae-995e-d411a95f8965.png?alt=media)
2. Your project should contain one end point, which is called "function\_1".

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-0425df7e7d5a663057fa55f039821d43c8221237%2F200f0aba-c10d-4d9c-bd7e-29536a30583e.png?alt=media)
3. Click on your project name. In the Viewer screen, click the *Details* node and click ***modify***.
4. In the *Security* section of the page, enable authentication (1) and add a user role (2 and 3). Save these changes.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-79befdb531caba1d77bab26798ea4fc955b9a653%2F5087e72b-1b90-40dc-89fb-1f828b11e77d.png?alt=media)
5. Publish your project, ensuring that you set a start code.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-611b59ec4e3ade0aedbbd8fca71d856ed7d5fba1%2Fab693e63-bc4b-432d-8ee0-d49c35ca7490.png?alt=media)

The URL of the WebAPIExample endpoint will look like the following: *https\://///*; for example, "<https://lua5.logicnets.local/logicnets/WebAPIExample/function\\_1>".

## Create a Server User

1. From your LogicNets dashboard, open AccessManagement.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-53637c6fa2872c5c01606f88d9573a7b1e9b782c%2F0188c5bd-f647-4bb0-9b51-8deb4e4307ba.png?alt=media)
2. Create a new user, ensuring the user type is set to *server* (1). Copy the client id for use below and click ***Add*** (2).

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-4a3b5c67c894adc4ef266f12ecb170db72d7d2c5%2F88470e9b-e6a3-4609-b10b-473fc7f8f3cc.png?alt=media)
3. Change Authentication Method to *Bearer Authentication with RS256 signed JWT Web token* (1) and click ***Generate new RSA key pair*** (2). Download the private key file or copy the generated private key for use below (3).

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-527a8eadca21cbf80987e4c5238c448618f35126%2F31135124-6d14-41c3-b8c1-066a99f6af4e.png?alt=media)
4. Click ***Save***.
5. Create a new user group called *webapiusers* (1) and click ***Add*** (2).

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-7ee71bf4c35d52982ffbff649a4722836d9d6f70%2Fdd7a5a1b-fa7c-448e-a92b-1369dfd26539.png?alt=media)
6. Add the server-user you created in the previous step as local user.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-de5e08983716b794b6c15ec3a6ec7d0ece97ba7c%2F6786dab0-0e22-45a5-8c21-74da7ccb9b5c.png?alt=media)
7. Add the *apiuser* role of the previously published WebAPIExample by selecting *WebAPIExample*(1) and selecting *apiuser* (2). Click ***Assign*** (3).

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-8a2ae638e2f8aa3333c0d8c10f35cde30d00b9a4%2F1b8285d9-783b-4877-963c-f4c470ae27a3.png?alt=media)
8. Save the user group.

## Create an Access Token to the WebAPIExample

With the steps above complete, you can use different clients to create an access token and access the WebAPIExample. This topic demonstrates using Postman (<https://www.postman.com/>), which has an integrated solution for calling OAuth2 IdPs to generate access-tokens. However, Postman does not support directly using a JWT-bearer as client-assertion-type (see <https://www.rfc-editor.org/rfc/rfc7523>), so in this tutorial we do this manually using [jwt.io](http://jwt.io).

1. Open <https://jwt.io/>.
2. Create a JWT token, by doing the following:
   * Copy and paste the following text in the HEADER field (1):
     * { "alg": "RS256", "typ": "JWT", "nonce": "” }
     * Copy and paste the following text in the PAYLOAD field (2): { "aud": "https\:///", "sub": "\<user-id/client-id>", "iss": ", "iat": , "exp": , "jti": "" }
     * Fill in the blanks:
       * **aud** (audience) - This must contain the hostname and the company of your LogicNets installation, e.g. [*https://lua5.logicnets.local/logicnets*](https://lua5.logicnets.local/logicnets).
       * **sub** (subject) – This must contain the client-id of the server-user you created earlier, e.g. *4664FD8C-9CEC-A8A2-D666-02A352A492A1*.
       * **iss** (issuer) – This must contain a valid identifier of the API client, e.g. [*https://client.org*](https://client.org).
       * **iat** (issued at) – This is the epoch time in seconds the JWT token was created. You can use <https://www.epochconverter.com/> to generate a valid epoch stamp of now 1695023951 (Mon, 18 Sep 2023 07:59:11 GMT).
       * **exp** (expires at) – This is the epoch time in seconds when the JWT token will expire; for example, 1 hours (=3600) later than when the JWT token was created: 1695027551.
       * **jti** – This must contain a unique identifier; for example, *f5203ecb-ae65-4a4b-8914-67baa258fca6*.
     * Copy and paste the private key generated when you created the server-user (3).

       ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-44d0a5e2c4e9fa74e7df45f62407c71227892b48%2F709712d9-6a17-4603-baa9-cf83f8d2578e.png?alt=media)
     * Copy the generated JWT token (4).
3. Start Postman.
4. Create a new GET request (1) and fill in the URL (*https\:////oauth2token* (e.g. [*https://lua5.logicnets.local/logicnets/oauth2token*](https://lua5.logicnets.local/logicnets/oauth2token)) (2), setting the following query parameters (3):
   * grant\_type must be "client\_credentials".
   * client\_assertion\_type must be "urn:ietf:params:oauth:client-assertion-type:jwt-bearer".
   * client\_assertion must contain the generated JWT token.

     ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-475e49cc9707c73bc8ddf8a3c652168028c0f30b%2F6729d442-ad97-4102-971e-07e1f8b835c9.png?alt=media)
5. Click ***Send*** (1) and copy the access\_token from the response body (2).

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-a89003a3627256b8e5bc77890859db544f82adf2%2F780068d6-e0b9-43e9-afc8-82cf741041b0.png?alt=media)
6. Create a new GET request to call the WebAPIExample.
   * Fill in the URL: *https\://///* (e.g. "<https://lua5.logicnets.local/logicnets/WebAPIExample/function\\_1\\_"\\>\_). Note: The system will return a 403 error if no authentication header is passed.

     ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-d7aea04b5d739894bcf905b9b753928ec3384970%2F7d0281b8-3da9-4c18-bc79-8e8cdcb8e964.png?alt=media)
   * To avoid a 403 error, you must add the authorization. Select *Bearer Token* (1) and copy and paste the access-token you generated earlier (2) in this process.

     ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-c2c276e49176d7d13a73e643617f1fa48dca86ed%2F24c478a0-7034-4f17-8142-d6e932b42208.png?alt=media)
   * Click ***Send*** (1). The response status should be "200 OK" and the body will return the example data (3).

     ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-aa9a41f0f66fdac3020f59cabc7d6b2443900595%2F7452f384-7433-4a54-963e-82b380aae5b6.png?alt=media)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://community-test.logicnets.com/release-9/platform-documentation/advanced-topics/webservice-api/how-to-use-the-oauth-2-0-client-credentials-flow-using-rs256-signed-jwt-bearer.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.