Understand OAuth2 Accounts

OAuth2 Accounts for authentication to OAuth2-based endpoints.

SnapLogic offers multiple OAuth2 account types that provide secure authentication and connection to various external data sources, APIs, and services.

Account types

SnapLogic Platform includes the following OAuth2 accounts:

  • OAuth2 Account
    • Supports Authorization Code (default), Client Credentials, and Password grant types.
    • Features auto-refresh tokens and bearer header authentication.
  • In Memory OAuth2 Account
    • Designed for short-lived access tokens (less than 30 minutes).
    • Supports only the Client Credentials grant type.
    • Stores the access tokens in cache.
  • SSL OAuth2 Account
    • OAuth2 authentication with SSL certificate support.
    • Supports multiple grant types, including Authorization Code, Client Credentials, and Password.
    • Includes KeyStore and TrustStore support.
  • Dynamic OAuth2 Account or Dynamic Access Token Account
    • Authentication to OAuth2-based endpoints.
    • Provides simple access token-based authentication.
    • Includes expression-enabled fields for dynamic values.

Key Components

  • Client ID & Secret: Application credentials from the service provider.
  • Authorization Endpoint: URL for user authorization.
  • Token Endpoint: URL for token retrieval and refresh.
  • Access Token: Short-lived token for API requests.
  • Refresh Token: Long-lived token for obtaining new access tokens.

OAuth2 Workflow in SnapLogic

The following infographic displays the step-by-step workflow of OAuth2 in SnapLogic:


OAuth2 workflow in SnapLogic

Step Description
Configuration

Set up Client credentials, Redirect URI, Scope, Endpoints, and Grant type.

  • Client Credentials: The Client ID and Client Secret are generated in the target endpoint. This acts as the unique identity for your SnapLogic "client" integration.
  • Redirect URI: SnapLogic dynamically generates the redirect URI based on the Snap Pack, and you must add this to the corresponding OAuth2 application on the server side. For example:
    • https://emea.snaplogic.com/api/1/rest/admin/oauth2callback/msdynamics365fo
    • https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/msdynamics365fo
  • Scope: Define the specific permissions your integration requires (for example, read, write, crm.objects). This ensures SnapLogic only accesses what is necessary for your pipeline.
  • Endpoints: You must provide the Authorization URI (to verify the user) and the Token URI (to exchange the code for the actual key).
  • Grant Type: The most commonly used grant type is Authorization Code (for user-authenticated access) or Client Credentials (for machine-to-machine access).
Authorization

Initiate the OAuth2 flow through the Authorize button (trigger the actual approval process).

  • Authorize: Within your SnapLogic Account settings, click the Authorize button. This launches a secure pop-up window connecting to the target endpoint.
  • User Consent: You (or a system admin) must log in to the external application and explicitly click Allow to grant SnapLogic permission to act on your behalf.
  • Callback: Once approved, the application sends a temporary authorization code back to SnapLogic via the configured Redirect URI.
Token generation and management

Once the user consents, the SnapLogic Platform automatically retrieves access and refresh tokens.

  • Exchange: SnapLogic immediately sends that authorization code to the Token URI.
  • Storage: The API returns an Access Token (the active key to the data) and a Refresh Token (the key to generate new access tokens).
  • Encryption: SnapLogic securely stores these tokens within the account metadata. They are now ready to be used by any pipeline you build that references this account.

Automatic refresh before expiration (if enabled).

  • Proactive Refresh: Access tokens are usually short-lived (for example, 60 minutes). If Auto-refresh is enabled, SnapLogic monitors the expiration timestamp.
  • Zero Downtime: Before the token expires, SnapLogic uses the Refresh Token to request a new Access Token in the background. This happens without interrupting your running pipelines.
    Note: The SnapLogic Platform refreshes OAuth2 tokens every 10 minutes, but these tokens will expire within the next 20 minutes. The existing tokens are replaced with the ones returned during the refresh.
API requests

With the tokens generated and managed, your integration is ready for production.

  • Header Injection: When your Snap (such as a HTTP Client or ServiceNow Read) executes, it automatically references the OAuth2 account you created.
  • Standardized Format: SnapLogic automatically adds the token to the HTTP Request header, typically as: 
    Authorization: Bearer <your_access_token>
  • Error Handling: If a request fails due to an expired token, SnapLogic can automatically attempt a refresh and retry the request.

Best Practices for Using OAuth2 Accounts in SnapLogic

  • Security
    • Use pipeline parameters (account.access_token) instead of hardcoded tokens.
    • Enable auto-refresh to prevent token expiration issues.
    • Integrate with enterprise Secrets Management systems.
  • Configuration
    • Set appropriate redirect URLs in your application settings in the following format: 
      https://<control-plane-name>.snaplogic.com/api/1/rest/admin/oauth2callback/<snap-pack-name>
      where the <control-plane-name> corresponds to the domain part of your SnapLogic URL—elastic (global control plane) or emea (EMEA control plane). For example:
      https://emea.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory
https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory
    • Configure custom properties for (OAuth2 token and Auth endpoint) specific API requirements, such as Scope.
  • Token Management
    • Enable auto-refresh for long-running pipelines.
    • Use In Memory OAuth2 accounts for frequently changing short-lived tokens.

OAuth2 Accounts in SnapLogic

The following table lists the OAuth2 Accounts available in SnapLogic, grouped by Snap Pack or category:
Snap Pack / Category OAuth2 Accounts
Coupa
Google Analytics and Google Directory
Google BigQuery
Exchange Online
Azure Data Lake Azure Data Lake Gen 2 OAuth2 Account
Dynamics 365 Dynamics 365 OAuth2 Account for Online
Eloqua Eloqua OAuth2 Account
Finance and SCM Finance and SCM OAuth2 Account
HubSpot HubSpot OAuth Account
In Memory In Memory OAuth2 Account
Marketo Marketo OAuth2 Account
Microsoft Entra ID Microsoft Entra ID OAuth2 Account
NetSuite REST NetSuite REST M2M OAuth2 Account
HTTP Client OAuth2 Account
Teams
REST
Salesforce
Shopify
Snowflake
OpenAPI