OAuth client (outbound connections)

An OAuth client connection lets the platform authenticate outward to a third-party API. You define the connection once in Management — connector key, account key, auth type, authorize/token URLs, client id, client secret, scopes and redirect URI — and its access/refresh tokens live in Management, encrypted at rest. WP-PFWorkflow runs the certified OAuth flow and applies the bearer token to your outbound calls.

What Management stores

• The connection definition, keyed by {connector, account} so one provider can have several accounts.
• The client secret, encrypted at rest with a key derived from your WordPress salts — it never crosses the REST boundary in the clear and is only decrypted in-process when the engine makes a call.
• The live access and refresh tokens, written back here after every exchange or refresh. Management is the single token store — see the Tokens table.

Connecting

For the authorization-code grant, the connection shows the exact redirect URI to register with your provider. The interactive consent and the token exchange run in WP-PFWorkflow (with PKCE where supported, automatic refresh, and SSRF protection on every token-endpoint call); an OAuth-backed connection therefore needs Workflow installed to run — see OAuth outbound connections.