> For the complete documentation index, see [llms.txt](https://docs.novacura.com/flow-ifs-cloud-development-guidelines/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.novacura.com/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/setup-client-credential-flow.md).

# Setup Client credential flow

## Setup overview in OData connector configuration

See Setup for obtaining required in information before configuring authentication. 

{% hint style="info" %}
Design time configuration is recommended to configure using with Client Credential model.
{% endhint %}

{% hint style="info" %}
Prepare IFS setup first and collect all information ready before configuring Client Credentials. Also when configuring, add fields in order from top to bottom.
{% endhint %}

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2F71CHwjHTxDaJGMf7lqx3%2Fimage.png?alt=media&amp;token=de25eb78-3bfc-4fa9-a934-c33542824d13" alt=""><figcaption><p>Example Client Credential setup</p></figcaption></figure>

### Setup

#### Access Token URL

Get **Access token URL** value from IFS Cloud.

{% content-ref url="/pages/pehKlFbKxppGwLyn2F5y" %}
[Obtaining Authentication related URLs from IFS Cloud](/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/obtaining-authentication-related-urls-from-ifs-cloud.md)
{% endcontent-ref %}

#### Client ID and Client Secret

Create one IFS service user and link it to new IAM Client.

**Create IFS service user**

Create IFS user type of Service User.&#x20;

{% hint style="info" %}
One cannot log into Aurena with IFS user type of service user.
{% endhint %}

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2FcTkse2l2V2R3p3wcr58N%2Fimage.png?alt=media&amp;token=1cca7bb7-b745-4865-9a77-0b73419d1ae7" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
It could be good idea to have novaura/nc and flow in the IFS user name?
{% endhint %}

**IFS Service user permissions**

Minimum privileges in that service user needs are

* CONNECT system privilege
* ProjectionExplorer projection

This enables the OData Connector to get projection list from IFS.

If Client Credentials authentication is used in Runtime setup (debugging in Studio or for integrations for example), service user must be granted&#x20;

* all projections required by flows
* company and site setup to enable data visibility etc.&#x20;

**Create IFS IAM Client**

Create IAM client like in example and link it to IFS service user.&#x20;

{% hint style="info" %}
Name IAM client so that it can be identified as being used by Flow. Also adding postfix describing authentication type would be a good idea.&#x20;

Example name: NC\_Flow\_ClientCredentials, Novacura\_ClientCredentials
{% endhint %}

<figure><img src="https://3323790987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJyIxKYxK0LMJ2T3XubCS%2Fuploads%2FSBCuqd3GMTLDEROjbACy%2Fimage.png?alt=media&amp;token=451812a4-fb17-4cbe-8d5d-4133c7272280" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Use same name for same type of IAM client in all customers IFS Cloud instances.
{% endhint %}

From saved IAM client, copy

* **Client ID** (character size matters, NC\_FlowClientCred is not the same as NC\_FLOWCLIENTCRED) to OData connectors *Client ID* and
* generated **Secret** to OData connectors *Client Secret.*

#### Scope(s)

Set default value of **openid microprofile-jwt** to OData connectors *Scope(s)*.

## Flow Server User Setup

Flow User setup has no link to IFS user so there are no special requirements for flow user setup.&#x20;


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.novacura.com/flow-ifs-cloud-development-guidelines/flow-development-with-odata/configuration/authentication-models/setup-client-credential-flow.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.