// This content is not included in any published doc.
// This vendor extension was planned, but not added.
// It might be implemented in the future.

id='access-token-strategy']
= Carrying the access token in a query parameter

In messages between {prodname} and a REST API that uses OAuth2, the
OAuth server expects the access token to be a `Bearer` value
in the `Authorization` header.
If you need to, you can change this default behavior so that
the access token is a parameter in the query that the OAuth server receives.

ifeval::["{location}" == "downstream"]

[IMPORTANT]
====
This is a
https://access.redhat.com/support/offerings/techpreview/[Technology Preview feature].

====
endif::[]

To specify that the access token is in a query parameter,
in the `securityDefinitions` section of the OpenAPI schema,
add the `x-token-strategy` vendor extension. In the example
below, the last line specifies `x-token-strategy`:

[source]
----
securityDefinitions:
  concur_oauth2:
    type: 'oauth2'
    flow: 'accessCode'
    authorizationUrl: 'https://example.com/oauth/authorize'
    tokenUrl: 'https://example.com/oauth/token'
    scopes:
      LIST: Access List API
    x-token-strategy: OAUTH_TOKEN_PARAMETER
----

The setting of the `x-token-strategy` vendor extension can be one of the
following:

* `OAUTH_TOKEN_PARAMETER` indicates that the access token is in the
`oauth_token` query parameter.

* `ACCESS_TOKEN_PARAMETER` indicates that the access token is in the
`access_token` query parameter.

* `AUTHORIZATION_HEADER`, the default, indicates that the access token
is in the `Authorization` header as an OAuth2 `Bearer` token.
