Customers using client IDs and client secrets from Oracle-provisioned Oracle Cloud Services applications to invoke Oracle Integration (OIC) flows must move to a customer-created Confidential Application.
OCI no longer displays client secrets for Oracle-provisioned Oracle Cloud Services applications. Previously retrieved secrets are rotated and no longer work. If a calling application still uses one of these credentials, it can no longer obtain an OAuth access token and its OIC invocation can fail.
Who is affected? Administrators in affected OC1 identity domains whose external applications, scripts, API gateways, or CI/CD jobs use credentials from an Oracle-provisioned application. Oracle services that use these applications internally, and applications already created by customers, are unaffected.
Why is this important for Oracle Integration orchestrations
An OIC REST trigger can be protected by OAuth. A service-to-service caller typically uses the OAuth 2.0 client-credentials grant: it presents a client ID and client secret to the identity-domain token endpoint, receives an access token, and sends that token to the OIC endpoint.
When the client secret came from an Oracle-provisioned Oracle Cloud Services application, secret rotation makes that credential invalid. The caller cannot obtain a token, so the OIC request does not succeed. This is a caller-credential issue, not a change to the OIC endpoint.
What you should do
If you are in the situation where you have been client secrets of Oracle Cloud Service application, then take the following actions.
- Identify affected callers. Inventory applications, scripts, API gateways, and CI/CD jobs that request OIC access tokens with a client ID and client secret. Confirm whether each credential originated from an Oracle-provisioned app or a customer-created integrated application.
- Create a customer-owned client application. In the OCI Console, open the relevant identity domain, select Integrated applications, then select Add application and Confidential Application. Use a clear, environment-specific name, such as
oic-invoker-prod. - Configure OAuth. Configure the application as a client, enable Client credentials for a service-to-service caller, and ensure the client type is Confidential.
- Add the OIC scopes. In the token issuance policy, add the Oracle Integration application for the target instance as an authorized resource. Select
urn:opc:resource:consumer::allandic/api/. - Assign the ServiceInvoker role. Under Oracle cloud services, open the target Oracle Integration application and assign the new confidential application to its ServiceInvoker application role.
- Activate and protect the credentials. Activate the confidential application, then retrieve its client ID and client secret. Store the secret only in the organization’s approved secret-management solution, never in source control or logs.
- Update and test each caller. Use the new credentials to request a token from the identity-domain token endpoint, then test a representative OIC endpoint invocation in every environment before completing production cutover.
Migration checklist
| Check | Expected outcome |
|---|---|
| Credential source verified | The existing credential is identified as Oracle-provisioned or customer-created. |
| Replacement app created | A dedicated Confidential Application exists for the caller and environment. |
| OAuth configured | Client credentials and Confidential client type are enabled where appropriate. |
| OIC scopes added | urn:opc:resource:consumer::all and ic/api/ are selected for the target OIC application. |
| Role assigned | The confidential application has the OIC ServiceInvoker role. |
| Secret stored safely | The client secret is held in an approved secrets store and is not exposed in code or logs. |
| End-to-end test passed | The caller obtains an access token and invokes the intended OIC endpoint. |
| Production cutover complete | Production callers use the new credentials and no longer reference the provisioned secret. |
Implementation notes
- Use separate confidential applications and secrets for development, test, and production.
- Select the OAuth grant that matches the caller. Client credentials is for confidential, non-interactive service clients; Oracle documents other grants for other use cases.
- Apply only the scopes and roles needed for the invocation.
- Plan secret ownership, storage, and rotation before cutover.
- Test the token request separately from the OIC endpoint. A rotated or invalid secret prevents token issuance before the OIC endpoint is reached.
Oracle documentation
- Client Secrets for Oracle-Provisioned Applications Are No Longer Visible
- Authenticate Requests for Invoking Oracle Integration Flows
Customers using client IDs and client secrets from Oracle-provisioned Oracle Cloud Services applications to invoke Oracle Integration (OIC) flows must move to a customer-created Confidential Application.