Credentials for OAuth
The Credentials for OAuth action step enables you to set up your OAuth credentials one time and then reference them in action steps that support OAuth Authentication. You can create a set of tokens that don’t rely on a user password to authenticate with the email server and then use the token to repeatedly log in to the services without asking for the user’s password again.
Properties
-
OAuth Authentication Settings
-
E-Mail Provider
Mail provider, either Outlook or Google.
-
Auth Endpoint
URL for the OAuth authentication endpoint. Defaults to the following values, depending on the selected provider:
-
Outlook:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize
-
Google:
https://accounts.google.com/o/oauth2/v2/auth
-
-
Token Endpoint
URL for the OAuth Refresh Token process. Defaults to the following values, depending on the selected provider:
-
Outlook:
https://login.microsoftonline.com/common/oauth2/v2.0/token
-
Google:
https://www.googleapis.com/oauth2/v4/token
-
-
Client ID
Client ID of your mail application.
To authenticate with the OAuth host, you must define an Azure or Gmail application in your space. This application has an ID, that is unique in the entire OAuth host space and it enables users to explicitly grant or revoke access for this application to their accounts.
For more information on how to create an Azure application for Outlook, visit Quickstart: Register an application with the Microsoft identity platform.
-
Client Secret
Client Secret of your mail application.
Allows RPA Builder to prove to the OAuth host that it received permission to access user accounts. Without this permission, authentication is not possible.
-
Redirect URI
URI that the OAuth host redirects to after the user completes the authentication attempt. This redirect URI must be registered with the Azure or Gmail application. If the entered redirect URI matches one of the registered URIs, the OAuth host allows the authentication.
-
Scopes
Defines which permissions the user grants to the Azure or Gmail application. By default, RPA Builder requests the following permissions depending on the selected provider:
-
Outlook
-
offline_access
(Required) Enables access via a refresh token, which you can use to repeatedly log in to the email services without requiring user interaction each time.
-
https://outlook.office.com/IMAP.AccessAsUser.All
(Required when using IMAP) Enables reading and moving emails from the Outlook IMAP server.
-
https://outlook.office.com/POP.AccessAsUser.All
(Required when using POP3) Enables reading emails from the Outlook POP3 server.
-
https://outlook.office.com/SMTP.Send
(Required when using SMTP) Enables sending emails from the Outlook SMTP server.
-
openid email
Enables RPA Builder to automatically detect the email account used to log in to the Azure application. If this scope is omitted, you must provide an email in the wizard.
-
-
Google
-
https://mail.google.com/
Enables RPA Builder to read, compose, send, and permanently delete emails from your Gmail account.
-
-
-
Save data to generate Tokens via the Tools menu
Saves the current data for further use when generating an OAuth refresh token.
-
Email address
The email address populates automatically if RPA Builder detects it from the authentication attempt. If the openid email scope is omitted, you must provide an email address manually.
-
Inbound Variables
-
OAuth Host Address
The host address used to get the credentials.
-
OAuth Client ID
The Azure application client ID.
-
Client Secret
The Azure application client secret.
-
Redirect Uri
The URI to which the OAuth Host redirects after the user completes the authentication attempt.
-
Scopes
The set of permissions the user grants to the Azure application.
-
E-mail Address
The email address.
-
Refresh Token
The OAuth refresh token.
Wizard
Follow these steps to authenticate with your credentials:
-
Complete the OAuth Authentication configuration by specifying the required properties.
Refer to Properties for a description of each property.
-
Click Authenticate.
This step starts the authentication process with the OAuth Host, which opens the login page in your default browser.
-
In the OAuth Host’s login page, complete the login process.
-
Close the browser.
After completing the last step, the wizard shows that you are authenticated:
Generate an OAuth Refresh Token
To generate and configure a refresh token:
-
In the Tools menu, select Generate OAuth Refresh Token.
-
Complete the OAuth Token Creator form that appears.
If you already configured the Credentials for OAuth action step details and clicked the Save data to generate Tokens via the Tools menu button, the data automatically populates with the last data you entered in the wizard.
-
Click Authenticate.
-
Click Copy Token to Clipboard.
-
Paste the token in an alphanumeric activity parameter.
-
Pin the variable to the field Refresh Token in the Credentials for OAuth wizard.
You can also pin the other values from the OAuth Token Creator.
By using an activity parameter, you don’t need to upload a new version of your Workflow to RPA Manager if your token expires or your user gets logged out of your email provider. In this case, regenerate the refresh token for the same user with the OAuth Token Creator and update the assigned activity parameter on RPA Manager.