<commit_before>---
id: page-plugin
title: Plugins - OAuth 2.0 Authentication
header_title: OAuth 2.0 Authentication
header_icon: /assets/images/icons/plugins/oauth2-authentication.png
breadcrumbs:
  Plugins: /plugins
nav:
  - label: Getting Started
    items:
      - label: Configuration
  - label: Usage
    items:
      - label: Endpoints
      - label: Create a Consumer
      - label: Create an Application
      - label: Migrating Access Tokens
      - label: Upstream Headers
  - label: oAuth 2.0 Flows
    items:
      - label: Client Credentials
      - label: Authorization Code
      - label: Resource Owner Password Credentials
---

Add an OAuth 2.0 authentication layer with the [Authorization Code Grant][authorization-code-grant], [Client Credentials][client-credentials], [Implicit Grant][implicit-grant] or [Resource Owner Password Credentials Grant][password-grant] flow. This plugin **requires** the [SSL Plugin][ssl-plugin] with the `only_https` parameter set to `true` to be already installed on the API, failing to do so will result in a security weakness.

----

## Configuration

Configuring the plugin is straightforward, you can add it on top of an [API][api-object] by executing the following request on your Kong server:

```bash
$ curl -X POST http://kong:8001/apis/{api}/plugins \
    --data "name=oauth2" \
    --data "config.enable_authorization_code=true" \
    --data "config.scopes=email,phone,address" \
    --data "config.mandatory_scope=true"
```

`api`: The `id` or `name` of the API that this plugin configuration will target.

You can also apply it for every API using the `http://kong:8001/plugins/` endpoint. Read the [Plugin Reference](/docs/latest/admin-api/#add-plugin) for more information.<commit_msg>docs(oauth2) add https_only note for Kong >= 0.10<commit_after>---
id: page-plugin
title: Plugins - OAuth 2.0 Authentication
header_title: OAuth 2.0 Authentication
header_icon: /assets/images/icons/plugins/oauth2-authentication.png
breadcrumbs:
  Plugins: /plugins
nav:
  - label: Getting Started
    items:
      - label: Configuration
  - label: Usage
    items:
      - label: Endpoints
      - label: Create a Consumer
      - label: Create an Application
      - label: Migrating Access Tokens
      - label: Upstream Headers
  - label: oAuth 2.0 Flows
    items:
      - label: Client Credentials
      - label: Authorization Code
      - label: Resource Owner Password Credentials
---

Add an OAuth 2.0 authentication layer with the [Authorization Code
Grant][authorization-code-grant], [Client Credentials][client-credentials],
[Implicit Grant][implicit-grant] or [Resource Owner Password Credentials
Grant][password-grant] flow. 

<br />

<div class="alert alert-warning">
  <strong>Note:</strong> As per the OAuth2 specs, this plugin requires the
  underlying API to be served over HTTPS. To avoid any confusion, we
  recommend that you configure your underlying API to be only served through
  HTTPS.
  <br />
  <br />
  If you are running Kong >= 0.10.0, you can learn to do so in the
  <a href="/docs/latest/proxy#configuring-ssl-for-an-api">Proxy Reference</a>
  where the <code>https_only</code> option is documented.
  <br />
  <br />
  If you are running Kong < 0.10.0, you must configure the
  <a href="/plugins/dynamic-ssl">SSL Plugin</a> on your API to have such an
  <code>https_only</code> flag.
</div>

----

## Configuration

Configuring the plugin is straightforward, you can add it on top of an [API][api-object] by executing the following request on your Kong server:

```bash
$ curl -X POST http://kong:8001/apis/{api}/plugins \
    --data "name=oauth2" \
    --data "config.enable_authorization_code=true" \
    --data "config.scopes=email,phone,address" \
    --data "config.mandatory_scope=true"
```

`api`: The `id` or `name` of the API that this plugin configuration will target.

You can also apply it for every API using the `http://kong:8001/plugins/` endpoint. Read the [Plugin Reference](/docs/latest/admin-api/#add-plugin) for more information.
{'fraction_non_alphanumeric': 0.10912698412698413, 'fraction_numerical': 0.012152777777777778, 'mean_word_length': 3.5213004484304933, 'pattern_counts': {'":': 0, '<': 21, '<?xml version=': 0, '>': 22, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4023793', 'n_tokens_mistral': 1253, 'n_tokens_neox': 1191, 'n_words': 428}