# Set up OAuth 2.0 with an OpenAPI tool

> intro

Source: https://help.kustomer.com/en_us/set-up-oauth-20-with-an-openapi-tool-HJyKTSftel

Last updated: 2026-03-19T20:24:31.917Z

Integrating AI Agents with [external APIs](https://help.kustomer.com/external-api-ai-agents-SyzSPAdF1l) requires a secure way to manage access. OAuth provides a safe, standardized way to authorize access without exposing sensitive credentials, ensuring that only approved applications can interact with your data. In this article, you’ll learn how to configure OAuth so your agents can securely access and use external tools.

### In this article

*   [Prerequisites](#1)
*   [Set up OAuth](#2)
*   [Considerations](#3)
*   [Best practices](#4)

### Prerequisites

Before you begin, ensure you have:

*   Administrator access to your Kustomer instance.
*   The following OAuth 2.0 credentials from the external service provider set up for the Authorization Code flow:
    *   **Client ID**
    *   **Client Secret**
*   The external service's Authorization URL and Token URL that support the Authorization Code grant type:
    *   **Authorization URL**  
        The endpoint where users are redirected to log in and grant permission to your application.
    *   **Token URL**  
        The endpoint where authorization codes are exchanged for access tokens.
*   An OpenAPI 3.0.0 specification for the external API that will interact with your tool.
*   Confirmation that your external service supports OAuth 2.0 Authorization Code flow.

### Set up OAuth 

Once you’ve gathered the required credentials, you can set up OAuth in your Kustomer instance to connect your external API.

1.  From the left navigation panel, click **Kustomer AI**.  
      
    
2.  Click **Tools,** then click **Add a tool**.   
      
    
3.  Select **OpenAPI**.  
      
    
4.  Enter a **name** and **description** for the tool. These fields should be descriptive of what the tool will do, as your AI Agent will use both of them to determine when and how to use the tool. For example:
    *   **Name:** Get file from Google Drive
    *   **Description:** This tool retrieves files from the user's Google Drive.  
          
        
5.  Next, **Add Authentication**, enter a name for the authentication method (for example, "_Google Drive OAuth 2.0_", select **OAuth 2.0** from the Authentication type drop-down menu, and set up the required fields: 
    *   **Client ID**  
        The client ID from your OAuth application registration. This identifies your application to the authorization server.  
          
        
    *   **Client secret**  
        The client secret from your OAuth application. This is used to authenticate your application with the authorization server.  
          
        
    *   **Authorization URL**  
        The URL where users will be redirected to log in and grant access to your application.  
          
        
    *   **Token URL**  
        The URL where authorization codes are exchanged for access tokens.  
          
        
    *   **Scopes**  
        The permissions your application needs.   
          
        
    *   **Client Credentials Method**  
        How to send client credentials during token requests. We recommend using **Client Secret Basic**.  
          
        
6.  Optionally, you can also enter the following:
    
    *   **Success redirect URL**  
        Redirect users here after successful authorization. If left blank, a default page will be shown.
        
    *   **Error redirect URL**  
        Redirect users here if authorization fails. If left blank, a default error page will appear.
        
    *   **Merge verification endpoint**  
        Set up an endpoint to verify authentication tokens before merging customers. Choose the HTTP method and enter the verification URL.  
          
        
7.  Select **Create** to save the authentication configuration. 
    

The newly created OAuth configuration is now available from the **Authentication** drop-down menu when configuring your tool.

![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/a4c92316516ee39f154bd422381147cf.png)

You can now enter your OpenAPI specification to finish setting up your tool. For more information on using an external API with AI Agents, see this [help article](https://help.kustomer.com/external-api-ai-agents-SyzSPAdF1l).

### Considerations

Please note that the following OAuth 2.0 features are not yet supported in AI Agent Studio:

*   **Refresh Tokens**  
    Access tokens cannot be automatically refreshed when they expire.  
      
    
*   **Additional OAuth 2.0 Grant Flows**   
    Only the Authorization Code grant flow is currently supported.

If your integration requires these features, contact our support team.

### Troubleshot common issues

If you run into problems while setting up or using OAuth with your external API tool, here are some common issues and solutions to help you resolve them quickly.

**Authentication Failures**

*   **Issue:** _"Invalid client credentials"_  
    **Solution:** Verify that your Client ID and Client Secret are entered correctly.  
      
    
*   **Issue:** _"Authorization URL not reachable"_  
    **Solution:** Ensure the Authorization URL is correct and accessible from your environment.

**Tool Not Being Used**

*   **Issue:** The tool doesn't appear to be used by the AI Agent.  
    **Solution:** Confirm that the tool is assigned to the AI Agent and that the AI Agent Team has been deployed.  
      
    
*   **Issue:** The tool is assigned to the AI Agent, but is not being used.  
    **Solution:** Update the AI Agent’s instructions to clearly specify when and how the tool should be used. Also, make sure the tool’s description accurately reflects its capabilities.

### Best practices

*   **Security:** Never share Client Secrets or store them in unsecured locations.
*   **Scopes:** Only request the minimum scopes necessary for your tool's functionality.
*   **Instructions:** Provide clear, specific instructions to your AI Agents about when and how to use the tool.
*   **Testing:** Always test the complete OAuth flow before deploying to production.