> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/2023-2/admin-essentials/integrations/auth/configure-auth-tokens/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure integration authentication tokens

> How Integration Token Management programmatically retrieves and manages authentication tokens for integrations.

You can configure your integrations to programmatically retrieve authentication tokens using the properties provided by the integration model for the schema integration.

Two types of configurations are currently available:

* `password`
* `clientCredentials`

You must manually configure these in when you import an integration model.

Although Itential designed this feature to work for as many services as possible, not all services are compatible with the `password` or `clientCredentials` configuration. Check the service to see if these configurations are provided.

## Property configurations

This section illustrates how to set the properties for the `password` and `clientCredentials` configuration.

![](/_fern-img/d66efb6a16da1fbbec7cb5104a0853fef4533f3a31b9cd0e636481cb9f5303b1.webp)![](/_fern-img/6a556f03d1fd10acc4eb992126c26581173904b89bc1524f72eaeb253a1fde2b.webp)

The only difference between the two is the property name in the `flows` object, and the `password` flow includes a `refreshUrl` parameter.

## Integration configurations

Depending on which configuration is used, you will see a specific configuration available on the **Integration Details** page. You will need to fill in the authentication fields in order for programmatic token retrieval to work properly.

For more detail on using integrations, see [Managing integrations](/itential-platform/admin-essentials/integrations/manage).

### Authentication

The following parameters support authentication configuration.

| Authentication parameter     | Description                                                                                                                                                                                               |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `client_id`, `client_secret` | Provided by the service in use. You must retrieve these from the service.                                                                                                                                 |
| `username`, `password`       | The account credentials to be used in the authentication.                                                                                                                                                 |
| `token_url`, `refresh_url`   | The endpoints that the service provides to retrieve authentication tokens. These fields will be populated upon creating the integration instance if the values are provided in the OpenAPI specification. |

### Token

The following fields are included in the `token` property of the integration configuration.

Editing these fields is not recommended, unless you would like to manually enter an `access_token` as it worked in previous versions of Itential Platform.

| Token parameter                 | Description                                                                                                                                                                                                                                                         |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `access_token`, `refresh_token` | Authorization tokens used with the integration tasks. The `access_token` will be retrieved programmatically if the field is empty or if the token is expired. If present with the `refresh_url`, the `refresh_token` will be used to retrieve a new `access_token`. |
| `token_type`                    | Type of token to be utilized. The default value is `Bearer`.                                                                                                                                                                                                        |
| `expires_in`                    | Length of time that the `access_token` will be valid.                                                                                                                                                                                                               |
| `expires_at`                    | Time at which the token will expire. Upon calling an integration task, this value is used to check if a new token should be retrieved.                                                                                                                              |
| `created_at`                    | Time at which the `access_token` was created.                                                                                                                                                                                                                       |
| `scope`                         | Scope provided by the token.                                                                                                                                                                                                                                        |

![](/_fern-img/eb70186c29bf51a9253dba98582f6e51e60aaf42ed6c98cf7b723e31793a488e.webp)![](/_fern-img/2ea9bcad26b08ce3c19f970a04c983888344ddfa34ed04164a5aaa941ec8874d.webp)

Once all configurations are completed, you can utilize integration tasks seamlessly without needing to continuously reconfigure your integration. Once the token is retrieved programmatically, it is stored in the MongoDB database available in Itential Platform.

> How Integration Token Management programmatically retrieves and manages authentication tokens for integrations.