You are browsing documentation for version 5.0 of OroCommerce, OroCRM, and OroPlatform, maintained until August 2024 and supported until March 2026. See version 5.1 (the latest LTS version) of the Oro documentation for information on latest features.

See our Release Process documentation for more information on the currently supported and upcoming releases.

OAuth Authentication

OAuth 2.0 is the industry-standard protocol for authorization. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices.

It is implemented by the OroOAuth2ServerBundle that supports OAuth 2.0 Authorization Code Grant, OAuth 2.0 Client Credentials Grant and OAuth 2.0 Password Grant.

For more details, see Manage OAuth Applications and Manage Customer User OAuth Applications.

Generate Tokens


In order to use OAuth authentication, private and public keys should be generated and placed to the server. Please contact your administrator or please follow the OroOAuth2ServerBundle documentation if you see the following error message:

The encryption key does not exist.


If the system has the customer portal package installed, OAuth authorization for customer users to the storefront API resources is enabled automatically.

Business Tip

Want to take advantage of the new digital commerce trend? Check out everything you need to know about a B2B wholesale marketplace.