// This module is included in the following assemblies:
// as_developing-rest-api-client-connectors.adoc

[id='providing-client-credentials_{context}']
= Provide client credentials in parameters

When {prodname} tries to obtain authorization to access an OAuth2 
application, it uses HTTP basic authentication to provide client
credentials. 
If you need to, you can change this default behavior so that
{prodname} passes client credentials to the provider as parameters instead of 
using HTTP basic authentication.
This affects the use of the `tokenUrl` endpoint that is used to obtain an 
OAuth access token.

ifeval::["{location}" == "downstream"]

[IMPORTANT]
====
This is a
https://access.redhat.com/support/offerings/techpreview/[Technology Preview feature].

====
endif::[]

To specify that {prodname} should pass client credentials as parameters, 
in the `securityDefinitions` section of the OpenAPI document, 
add the `x-authorize-using-parameters` vendor extension with a setting of
`true`. In the example
below, the last line specifies `x-authorize-using-parameters`:

[source]
----
securityDefinitions:
  concur_oauth2:
    type: 'oauth2'
    flow: 'accessCode'
    authorizationUrl: 'https://example.com/oauth/authorize'
    tokenUrl: 'https://example.com/oauth/token'
    scopes:
      LIST: Access List API
    x-authorize-using-parameters: true
----

The setting of the `x-authorize-using-parameters` vendor extension is `true` or
`false`:

* `true` indicates that client credentials are in parameters. 

* `false`, the default, indicates that {prodname} uses HTTP
basic authentication to provide client credentials.  
