在此页面上：了解如何在Adobe Journey Optimizer中为自定义渠道配置OAuth 2.0身份验证，包括令牌请求有效负载、凭据路径、令牌提取和令牌在投放请求中的位置。
当您在创建自定义渠道时选择 OAuth 2.0 作为身份验证类型时，请配置Adobe Journey Optimizer用来从授权服务器检索访问令牌的令牌请求。
Journey Optimizer使用endpoint、method、request和policy配置发送令牌请求。 然后，它使用tokenPath从响应中提取访问令牌，并使用locationConfig将其添加到投放请求中。
OAuth 2.0身份验证有效负载配置对 令牌端点 的请求。 它与发送到自定义渠道投放端点的消息有效负载不同。
配置令牌请求 token-request
使用以下示例配置您的令牌请求。 将示例端点和凭据值替换为授权服务器所需的值。 示例中的headers和queryParams条目是可选的：如果您的令牌端点不需要它们，请删除它们，并从credentialPaths中删除匹配的条目。
窗体正文示例 form-body-example
当令牌终结点需要表单字段（如grant_type、client_id或client_secret）时，请使用form有效负载。
{
"type": "oauth2",
"endpoint": {
"uri": "https://auth.example.com/oauth/token"
},
"method": "post",
"request": {
"headers": [
{
"key": "sampleHeaderKey",
"value": "sampleHeaderValue"
}
],
"queryParams": [
{
"key": "sampleQueryParamKey",
"value": "sampleQueryParamValue"
}
],
"payload": {
"type": "form",
"content": [
{
"key": "grant_type",
"value": "client_credentials"
},
{
"key": "client_id",
"value": "your-client-id"
},
{
"key": "client_secret",
"value": "your-client-secret"
}
],
"includeNullValues": false
}
},
"response": {
"type": "json"
},
"policy": {
"timeoutInMilliseconds": 30000,
"cache": {
"enabled": true,
"ttlInSeconds": 300
},
"retry": {
"enabled": false,
"maxRetryCount": 3
}
},
"credentialPaths": [
"header.sampleHeaderKey",
"queryParam.sampleQueryParamKey",
"payload.client_id",
"payload.client_secret"
],
"tokenPath": "access_token",
"locationConfig": {
"key": "Authorization",
"location": "header"
}
}
对于form有效负载，每个凭据路径都使用表单字段键，例如payload.client_secret。 不在凭据路径中包含content或数组索引。
JSON正文示例 json-body-example
当令牌终结点需要JSON请求正文时，请使用json有效负载。
{
"type": "oauth2",
"endpoint": {
"uri": "https://auth.example.com/oauth/token"
},
"method": "post",
"request": {
"headers": [
{
"key": "sampleHeaderKey",
"value": "sampleHeaderValue"
}
],
"queryParams": [
{
"key": "sampleQueryParamKey",
"value": "sampleQueryParamValue"
}
],
"payload": {
"type": "json",
"content": {
"grant_type": "client_credentials",
"client_id": "your-client-id",
"client_secret": "your-client-secret"
},
"includeNullValues": false
}
},
"response": {
"type": "json"
},
"policy": {
"timeoutInMilliseconds": 30000,
"cache": {
"enabled": true,
"ttlInSeconds": 300
},
"retry": {
"enabled": false,
"maxRetryCount": 3
}
},
"credentialPaths": [
"header.sampleHeaderKey",
"queryParam.sampleQueryParamKey",
"payload.client_id",
"payload.client_secret"
],
"tokenPath": "access_token",
"locationConfig": {
"key": "Authorization",
"location": "header"
}
}
OAuth 2.0字段 oauth2-fields
字段
描述
type必须为
oauth2。endpoint.uriOauth 2.0令牌端点的HTTPS URL。
method用于调用令牌端点的HTTP方法。 将
post用于令牌请求。request.headers发送到令牌端点的可选标头。
request.queryParams附加到令牌端点URL的可选查询参数。
request.payload令牌请求正文。 支持
form和json负载。request.payload.includeNullValues定义令牌请求正文中是否包含具有null值的字段。
response.type响应格式。 当令牌终结点返回JSON响应时使用
json。policy.timeoutInMilliseconds等待令牌终结点响应的最长时间。
policy.cache定义是否缓存OAuth令牌及其时长。
policy.retry令牌端点故障的可选重试配置。
credentialPaths请求包含凭据的字段的路径。 这些字段被视为凭据，可以安全地管理。
tokenPathOAuth响应中访问令牌的点分隔路径，例如
access_token或data.access_token。locationConfig定义将检索到的令牌添加到投放请求的位置。
locationConfig.key携带令牌的标头或查询参数的名称，例如
Authorization。locationConfig.location添加令牌的位置：
header或queryParam。启用令牌缓存后，Journey Optimizer会在配置的缓存持续时间内重用OAuth令牌，而不是为每个投放请求调用令牌端点。
标识凭据字段 credential-paths
使用credentialPaths确定哪些请求字段包含凭据。 如果标头或查询参数包含凭据，请将其路径以及任何凭据路径包含在请求正文中。 上面的示例将示例标头和查询参数值标识为凭据；调整此列表以匹配您的请求。
前缀
用于
示例
header.在请求标头中传递的凭据。
header.sampleHeaderKeyqueryParam.传入查询参数的凭据。
queryParam.sampleQueryParamKeypayload.在请求正文中传递的凭据。
payload.client_secret应用以下规则：
- 路径必须以
header、queryParam或payload开头，并使用点作为分隔符。 - 对于
form负载，使用payload.<formFieldKey>。 - 对于
json负载，使用JSON对象路径，如payload.client_id或payload.credentials.client_secret。 不要在路径中包含content。 - 不支持空路径段。 例如，
payload..client_id无效。
对于嵌套JSON主体，请使用点表示法，如以下配置摘录中所示：
{
"request": {
"payload": {
"type": "json",
"content": {
"credentials": {
"client_id": "your-client-id",
"client_secret": "your-client-secret"
}
},
"includeNullValues": false
}
},
"credentialPaths": [
"payload.credentials.client_id",
"payload.credentials.client_secret"
]
}
提取访问令牌 token-path
tokenPath定义访问令牌在OAuth 2.0令牌响应中的位置。
对于以下响应，将tokenPath设置为access_token：
{
"access_token": "example-access-token",
"token_type": "Bearer",
"expires_in": 3600
}
对于嵌套响应，将tokenPath设置为data.access_token：
{
"data": {
"access_token": "example-access-token"
}
}
将令牌添加到投放请求 token-location
locationConfig定义Journey Optimizer在调用自定义渠道投放端点时添加检索到的令牌的位置。
要在Authorization标头中发送令牌，请使用：
{
"locationConfig": {
"key": "Authorization",
"location": "header"
}
}
位置
描述
header将令牌添加为HTTP标头。
queryParam将令牌添加为查询参数。
限制和验证规则 limits
字段
限制
endpoint.uri必须为包含非空主机的绝对HTTPS URL。 最大长度：2048个字符。
policy.timeoutInMilliseconds最小值：300毫秒。 最大值：60000毫秒。
policy.cache.ttlInSeconds在启用缓存时应用。 最少：300秒。 最大值：3600秒。
request.headers最多50个标头。 标头键长度：1-100个字符。 标头值最大值：8192个字符。
request.queryParams最多50个查询参数。 查询参数键长度：1-100个字符。 查询参数值的最大值：8192个字符。
request.payload.type=form最多50个表单字段。 表单密钥长度：1-100个字符。 不允许存在重复的表单键。
凭据值
1-1024个字符。
tokenPath必须为有效的点分隔路径。 仅当整个响应是令牌时才允许空值。
credentialPaths必须以
header、queryParam或payload开头，并使用点作为分隔符。后续步骤 next-steps
AI Knowledge Reference
This section contains structured knowledge intended to support interpretation, retrieval, and question answering related to this topic.
For complete understanding, this information should be combined with the documentation on this page. Neither source is intended to stand alone; the page describes the feature, while this section provides additional context that helps disambiguate terminology, intent, applicability, and constraints.
- TL;DR: Configure OAuth 2.0 authentication for a custom channel by defining the token endpoint request, identifying credential fields, extracting the access token from the response, and specifying where to add it to delivery requests.
Intents:
- Configure OAuth 2.0 authentication when creating a custom channel or managing API credentials
- Choose a form or JSON body for the token endpoint request
- Identify credential fields in headers, query parameters, and request bodies
- Extract an access token from a top-level or nested response field
- Add the retrieved token to a delivery request header or query parameter
- Understand token caching and authentication configuration limits
Glossary:
- Token endpoint: The authorization server endpoint that Journey Optimizer calls to retrieve an access token
- Authentication payload: The configuration of the OAuth 2.0 token request, separate from the message payload sent to the delivery endpoint (product-specific)
- Credential paths: The paths identifying request fields that contain credentials, configured through
credentialPaths(product-specific) - Token path: The dot-separated path to the access token in the token endpoint response, configured through
tokenPath(product-specific) - Token location configuration: The delivery request header or query parameter to which the retrieved token is added, configured through
locationConfig(product-specific)
Guardrails:
- Set the authentication configuration
typetooauth2and usepostfor token requests. - The token endpoint must be an absolute HTTPS URL with a non-empty host and a maximum length of 2048 characters.
- Token request bodies support
formandjsonpayloads; choose the format expected by your authorization server. - Credential paths must start with
header,queryParam, orpayload, use dots as separators, and contain no empty path segments. - Form credential paths use the form field key. JSON credential paths use the JSON object path. Do not include
contentor form array indexes in credential paths. - Supported token locations are
headerandqueryParam. - The token endpoint timeout must be between 300 and 60000 milliseconds.
- When token caching is enabled, the cache duration must be between 300 and 3600 seconds. Journey Optimizer reuses the token for the configured duration instead of retrieving a token for every delivery request.
- Credential values must contain between 1 and 1024 characters.
- An empty
tokenPathis allowed only when the entire response is the token.
Terminology:
- Canonical name: OAuth 2.0 authentication - variants: OAuth 2.0 authentication payload, OAuth token request configuration
- Do not confuse: “authentication payload” (configuration for retrieving an access token) with “message payload” (content sent to the custom channel delivery endpoint)
- Do not confuse:
credentialPaths(credential fields in the token request) withtokenPath(access token field in the token response) - Do not confuse:
request.headersandrequest.queryParams(values sent to the token endpoint) withlocationConfig(where the retrieved token is added to delivery requests)
FAQ:
- Q: When should I use a form or JSON payload? - Use
formwhen the token endpoint expects form fields, andjsonwhen it expects a JSON request body. - Q: How do I identify a client secret in a form body? - Use the form field key, for example,
payload.client_secret, withoutcontentor an array index. - Q: How do I identify credentials in a nested JSON body? - Use dot notation, for example,
payload.credentials.client_secret. - Q: How do I extract a token from a nested response? - Set
tokenPathto the response field path, for example,data.access_token. - Q: Where can Journey Optimizer add the token to delivery requests? - Set
locationConfig.locationtoheaderorqueryParamandlocationConfig.keyto the header or query parameter name. - Q: Does Journey Optimizer retrieve a token for every delivery request? - When caching is enabled, it reuses the token for the configured cache duration.
recommendation-more-help
journey-optimizer-help