---
title: "OAuth Authorization Configuration"
id: "oauth-authorization-configuration"
project: "MES User Manual"
url: "https://docs.sepasoft.com/articles/user-manual/oauth-authorization-configuration"
updated: 2026-11-02T15:07:43Z
---

# OAuth Authorization Configuration

**Sepasoft MES Module Suite**
 ### OAuth Overview

OAuth 2.0 is an authorization framework that allows third-party applications to access user resources, such as data or APIs, without having to share the user's credentials.

Here is how OAuth 2.0 works in web services:

* The user authorizes the third-party application to access their resources. This authorization is typically done through a web browser, where the user is presented with a consent screen.
* The third-party application requests an access token from the authorization server. The access token is a credential that grants the third-party application access to the user's resources.
* The authorization server validates the request and issues an access token to the third-party application.
* The third-party application uses the access token to access the user's resources.

![](/resources/Storage/user-manual/oauth-authorization-configuration/image2023-8-21_10-18-14.png)

OAuth 2.0 has several advantages over other authorization frameworks, such as:

* It is secure: OAuth 2.0 does not require the user to share their credentials with the third-party application.
* It is scalable: OAuth 2.0 can be used to authorize large numbers of users and applications.
* It is flexible: OAuth 2.0 can be used to authorize access to a variety of resources, such as data, APIs, and files.

#### Adding Authorization Code in OAuth Settings

Before following these steps, **be sure to set the HTTP Authentication Type**: RESTful Configuration HTTP Authentication.

The Web Services node in the Project Browser is in the configuration project that you set in the gateway. It's set to the **MESGateway** project by default.

* In the **Ignition Designer** **Project Browser** > **Web Services** > **OAuth**, right click **Authorization Code OAuth**and select **New OAuth**.

![](/resources/Storage/user-manual/oauth-authorization-configuration/oauth-authorization-configuration-2026-11-02.png)

| Auth Fields | Description |
| --- | :--- |
| **Authorization URL** | The endpoint for the authorization server. This is used to get the authorization code. |
| **Access Token URL** | The endpoint for authentication server. This is used to exchange the authroization code for an access token. |
| **Client ID** | The client identifier issued to the client during the Application registration process. |
| **Client Secret** | The client secret issued to the client during the Application registration process |
| **Scope** | The scope of the access requests. It may have multiple space delimited values. Some authorization servers require offline\_access to refresh the authorization token. |
| **State** | **Added in 3.81.13 SP5 and 4.83.3 SP5.** Sends the OAuth state parameter on the authorization request and checks that the authorization server returns the same value. This protects the callback from cross-site request forgery. Existing configurations stay on Disabled. |
| **Hostname** | This is the gateway hostname taken from the settings used to launch the designer. |
| **Callback URL (read-only)** | This is the URL to register with the authorization server. This is where the authorizations server will send the token to allow access to restricted APIs. |

State has three modes.
| Mode | Behavior |
| --- | --- |
| **Disabled** | Default. No `state` parameter is sent. The Status area warns: "State validation is disabled. OAuth authorization responses may be vulnerable to CSRF attacks. Select Enabled for production use." |
| **Enabled** | Each authorization request gets a new random `state` value. Web Services stores it for the session and accepts the authorization code only when the callback returns the same value. A mismatch is rejected with "Invalid OAuth state." |
| **Debug** | Sends the text in the State field. Generate Random State fills that field with a new value. Debug does not check the value that comes back. Choosing Debug opens a warning, and the Status area repeats it: do not use Debug in production, because a fixed State value does not protect against CSRF. |
Use HTTPS for the authorization and callback URLs. The State value travels in the authorization URL.

* Once configured **save the project**. Then, click **Authorize URL** to open a browser and sign in to allow access on your behalf from the Web Service module.

> 
> **Copy Authorization URL** gives you the URL that would be opened in the browser by the Authorize button.

![](/resources/Storage/user-manual/oauth-authorization-configuration/image%20%2816%29.png)
* Green status checkmarks lets you know the token is ready for use. RESTful consumers have a new HTTP Authentication type of OAuth. Once selected you can choose a preconfigured OAuth token item that sends a bearer token with each request.

![](/resources/Storage/user-manual/oauth-authorization-configuration/image%20%2817%29.png)
 **Related Topics:**

* [Consumers](/articles/user-manual/restful-configuration)
* [Providers](/articles/user-manual/providers)
 
**Sepasoft MES Module Suite**