**Source URL:** https://limited.veevavault.dev/quality/library/guides/setting-up-oath

# Setting Up OAuth 2.0 with Entra for Integration Accounts

The following guide outlines how to authenticate to Vault API using OAuth 2.0, using a token from Postman to obtain a valid Vault session ID. Integrating external applications with Vault requires an integration user account to facilitate communication between the two systems. These accounts must rely upon OAuth 2.0 to authenticate since they can never access the Vault UI directly. Learn more about [configuring OAuth 2.0 profiles](https://platform.veevavault.help/en/lr/43329).

The types of integration user accounts are:

*   **Non-human**: does not require a physical user to authenticate
*   **API-focused**: primarily interacts with systems via APIs rather than graphical user interfaces (GUIs)

## Prerequisites

You must satisfy the following prerequisites before proceeding with the authentication process:

*   [Register an application with Microsoft Entra and configure OAuth 2.0 profiles](https://platform.veevavault.help/en/lr/43329#configure-oauth-entra-api-user-accounts)
*   A [Postman account](https://identity.getpostman.com/signup?authFlowId=60db6664-d1a5-4df8-9dcb-ab3428e6afcf) with the [imported Vault Platform Postman Collection](/vault-api/guides/postman-collection/setting-up-postman/#importing-collections)

## Authenticating with OAuth 2.0

To authenticate with OAuth 2.0:

<Steps>
1.  In your Vault Platform Postman Collection, navigate to the **Veeva Vault API \[version\]** > **Authentication** > **OAuth 2.0 / OpenID Connect** endpoint.
    
2.  Select the **Authorization** tab and change the **Auth Type** to **OAuth 2.0**.
    
    <ThemeImage srcLight="/images/integrations/26r2_postman_oauth_light.png" srcDark="/images/integrations/26r2_postman_oauth_dark.png" alt="Postman Authorization tab showing the Configure New Token section" />
    
3.  Under *Configure New Token*, set the following values:
    
    *   Set **Grant type** to **Authorization Code (With PKCE)**.
    *   Select **Authorize using browser**.
    *   Populate **Auth URL** with the **OAuth 2.0 authorization endpoint (v2)** obtained from your Entra ID application.
    *   Populate **Access Token URL** with the **OAuth 2.0 token endpoint (v2)** obtained from your Entra ID application.
    
    <ThemeImage srcLight="/images/integrations/26r2_entra_oauth_light.png" srcDark="/images/integrations/26r2_entra_oauth_dark.png" alt="Entra ID application Endpoints panel showing the OAuth 2.0 authorization and token endpoints" />
    
    *   Populate **Client ID** with the **Application (client) ID** from your Entra ID application.
    *   Leave **Client Secret** blank.
    *   Set **Code Challenge Mode** to **SHA-256**.
    *   Populate **Code Verifier** with a random, 43-128 character string. Vault API uses this value to connect the authorization request to the token request.
    *   Populate **Scope** with your Entra ID **Application (client) ID** with `/.default` appended to the end. For example, `a1462b8b-7d69-4313-87c8-0897576cab6f/.default`.
    *   (Optional) Populate a **State**, which is an opaque value used for preventing cross-site request forgery.
    *   Set **Client Authentication** to **Send client credentials in body**.
4.  Scroll down and click **Get new access token**.
    
5.  Once authenticated, click **Use Token**.
    
6.  Select the **Headers** tab and clear the **X-VaultAPI-ClientID** checkbox.
    
7.  Select the **Headers** tab, then select the checkbox for **vaultDNS** and **client\_id**. Set **client\_id** to the **Application Client ID** from your client application in Vault.
    
8.  Copy the **Vault Session ID URL** from your OAuth 2.0/OpenID Connect profile in Vault and paste it into the URL box in Postman.
    
    <ThemeImage srcLight="/images/integrations/26r2_postman_oauth_request_light.png" srcDark="/images/integrations/26r2_postman_oauth_request_dark.png" alt="Postman request URL with Vault Session ID URL" />
    
9.  Click **Send**.
</Steps>