1. Walkthrough: Using an authorization item

Webhook authentication types

This topic describes the types of authentication available for webhooks.

To include authentication when sending a webhook request, create an authorization item and assign it to the webhook.

Sitecore supports the following authentication types:

Type of authenticationRequired fields
BasicUsername

Password
DigestUsername

Password
API keyKey

Value

Add to
OAuth2.0 Client Credentials GrantAuthority URL. This is the identity provider base/authority endpoint used for discovery and token validation. It is not the token endpoint

Client ID

Client Secret

Scope. Expected format depends on provider (space-separated string or single scope value).

Header Prefix. Used in the Authorization header. The default value is Bearer

Additional endpoint base addresses. This is required for some providers.

Sample field values:
Authority URL: https://login.microsoftonline.com/<tenant-id>/v2.0
Client ID: <your-client-id>
Client Secret: <your-client-secret>
Scope: https://graph.microsoft.com/.default
Header Prefix: Bearer
Additional Endpoint Base Addresses: https://login.microsoftonline.com/<tenant-id>;https://graph.microsoft.com/oidc/userinfo

Note
Common misconfigurations:
- Authority URL
   Incorrect: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
   Correct: https://login.microsoftonline.com/<tenant-id>/v2.0
- Missing or incorrect Additional Endpoint Base Addresses for Microsoft providers
OAuth2.0 Password Credentials GrantAuthority URL. This is the identity provider base/authority endpoint used for discovery and token validation. It is not the token endpoint

Client ID

Client Secret

Scope. Expected format depends on provider (space-separated string or single scope value).

Header Prefix. Used in the Authorization header. The default value is Bearer

Username

Password

Additional endpoint base addresses. This is required for some providers.
Note

You can pass optional fields to use the OAuth2.0 client credentials grant and OAuth2.0 password credentials grant authentication types.

Note

Some identity providers require specifying an address in the Additional Endpoint Base Addresses field. For Microsoft Azure and Azure B2C providers, set this value to https://login.microsoftonline.com/<tenant id>;https://graph.microsoft.com/oidc/userinfo.

If you have suggestions for improving this article, let us know!