Question
bitsinglass
IN
Last activity: 3 Oct 2025 17:26 EDT
DX API OAuth 2.0 Authorization Code Implementation
Hello,
Anyone implemented authorization code in DX API OAuth 2.0 implementation? I have tried client credentials ( not for user) and password credentials(not recommended for production), but still exploring on the authorization code. When we create an application in Pega 24.2 , it creates an oAuth 2.0 cllient registration instance with grant type 'Authorization Code' , not sure how useful it is for creating a connect rest rule from DX API Endpoint.
HCA Healthcare
US
use Authorization Code + PKCE only for a browser-based app calling DX API on behalf of a signed-in user; do not use it from a Connect REST rule because that flow requires interactive redirects. In Pega 24.2 the auto-created OAuth 2.0 Client Registration (grant type Authorization Code) is meant for Constellation/DX login and the DX “Try it” console, not for server-to-server calls. For calling DX API from another Pega node or any backend, configure an OAuth 2.0 Authentication Profile with Client Credentials, scope it to the right access group/roles, and have the target instance expose DX endpoints under a service package that enforces OAuth. If you truly need user context, obtain the user token in the front end via Auth Code + PKCE and forward that bearer token to your backend (token passthrough), rather than trying to run the code flow inside Connect REST. Concrete steps: create OAuth 2.0 Client Registration (for auth-code or client-credentials as appropriate), create an Authentication Profile, apply it to your Connect REST, and test DX endpoints with that token. Docs: DX API security recommends code flow with PKCE for user apps, while OAuth profiles/registrations cover how to wire Client Credentials for backend calls