> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Create OAuth tokens for calling Revenue APIs

> Learn how to create an OAuth 2.0 client using the client credentials grant type in the OneID portal.

Learn how to create an OAuth 2.0 client using the client credentials grant type in the OneID portal.

* An active OneID account with permission to manage OAuth 2.0 clients in the target tenant.
* Access to the Zuora Revenue tenant for which you want to generate tokens.

Zuora Revenue APIs use OAuth 2.0 bearer tokens for authentication. To obtain an access token, you first need an OAuth 2.0 client, which consists of a client ID and a client secret. You create and manage these clients in the OneID portal, Zuora's centralized identity and access management service for Zuora products.

The client credentials grant type is intended for server-to-server integrations where the client application acts on its own behalf rather than on behalf of an end user. After you create a client, your application exchanges the client ID and client secret for a short-lived access token, which you then include in the `Authorization` header of each Revenue API request.

In the upper-right corner of the OneID portal, click your avatar, and then click **Settings**.

The Settings page opens.

Click **Manage OAuth 2.0 Clients**.

On the Manage OAuth 2.0 Clients page, click **New**.

The New OAuth 2.0 Client window opens.

Specify values for the following fields:

* In the **Name** field, enter a name for the client.
* In the **Authorization Grant Type** list, select **Client Credentials**.
* In the **Scope Type** list, select **USER**. This scope ties the token to a specific user's permissions in the selected tenant.
* In the **Select User** list, select the user whose permissions the client will inherit. The access token issued for this client can perform only the actions that this user is authorized to perform.
* In the **Tenant ID** list, select the Zuora Revenue tenant that the client will access.

Click **Save**.

After the client is created, a window that contains the client ID and client secret opens.

Record the client ID and client secret, and store them in a secure location, such as a secrets manager.

> **Warning**
>
> The client secret is displayed only once and cannot be retrieved later. If you lose the client secret, you must create a new OAuth 2.0 client.