...
Log into the Coupa portal. The URL format for Coupa instances:
Customer instances:https://{organization_name}.coupahost.com
Partner and demo instances:https://{organization_name}.coupacloud.comNavigate to Setup > Integrations > Oauth2/OpenID Connect Clients.
Note: You can also search for ‘oauth’ in the Find it fast search box.
Click Create in Oauth2/OpenID Connect Clients page.
From the Grant type list, select Client credentials.
Specify the details for the client, such as Name, Login, Contact First Name, Contact Last Name, and Contact Email as shown in the image below:
Note: You must provide a unique login ID for Client Credentials Grant type,else Coupa displays an error,
Login has already been taken.Select the Scopes you want to include in this API setup.
Note: To create a client app, we must select at least one scope and the scopes which provide access to specific APIs required for your functionality.Click Save to save the client.
The client Identifier and Secret are generated. You can toggle the Show/Hide link to display and copy the client secret.
You can use the values of Client ID and Client Secret to gain access to the Coupa APIs. When you create a new Open Connect client, access is granted to a specific application or user client for specific areas of the product, defined by scopes.
...
Steps 1 through 3 are common as mentioned in Configuring an OAuth App with Client Credentials Grant type.
From the Grant type list, select Authorization code.
Specify the details for the client as shown in the image below.
Select Shared secret.
Mandatory. Select
offline_accessscope under Scopes.Click Save. The client Identifier and Secret are generated. You can toggle the Show/Hide link to display and copy the client secret.
Generating PKCE (Proof Key for Code Exchange) with Authorization code
...
code_verifier: The code verifier should be a high-entropy cryptographic random string with a minimum of 43 characters and a maximum of 128 characters. Should only use A-Z, a-z, 0–9, “-”(hyphen), “.” (period), “_”(underscore), “~”(tilde) characters.
code_challenge: The code challenge is created by SHA256 hashing the code_verifier and base64 URL encoding the resulting hash.
Base64UrlEncode(SHA256Hash(code_verifier)). And each pair is used only once.code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier))).
code_challenge_method: It is used to state the method (the available value is “S256”) used to transform the code verifier into the code challenge and if you don’t use it an Authorization Server will assume that the code challenge and the code verifier are the same.
Requesting an OpenID Connect
...
Access Token to use in Coupa Dynamic OAuth2 account
Once you have created a client, the next step is to request for an access token.
...