Pega · Authentication Profile

Pega Authentication

Authentication

Pega secures its APIs with oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and authorizationCode flow(s).

CompanyLow-CodeBusiness Process ManagementWorkflow AutomationCRMDecisioningArtificial IntelligenceEnterpriseCase Management
Methods: oauth2 Schemes: 2 OAuth flows: clientCredentials, authorizationCode API key in:

Security Schemes

OAuth2 Client Credentials oauth2
OAuth2 Authorization Code (PKCE) oauth2

Source

Authentication Profile

pega-authentication.yml Raw ↑ 
generated: '2026-07-20'
method: searched
source: https://github.com/pegasystems/pega-launchpad-agent-skills (launchpad-dx-apis/webembed SKILL.md) + docs.pega.com DX API authentication
docs: https://docs.pega.com/bundle/platform/page/platform/dx-api/dx-api-overview.html
summary:
  types: [oauth2]
  oauth2_flows: [clientCredentials, authorizationCode]
  notes: >-
    Pega DX APIs authenticate with OAuth 2.0. Access is granted via an OAuth 2.0
    Client Registration rule in the Pega/Launchpad environment; the Persona bound
    to the client registration determines the access roles and privileges (and
    therefore which DX API operations the credentials may invoke). Callers are
    provisioned an Application URL, an Access Token URL, a Client ID and a Client
    Secret.
schemes:
  - name: OAuth2 Client Credentials
    type: oauth2
    flow: clientCredentials
    token_url_pattern: "https://<accessTokenURL>/token"
    grant: client_credentials
    used_for: Server-to-server / external-system DX API integration (create case, get case, run action, query data views).
    role_binding: Persona on the Client Registration rule
  - name: OAuth2 Authorization Code (PKCE)
    type: oauth2
    flow: authorizationCode
    pkce: true
    used_for: Browser/embedded experiences (e.g. the <pega-embed> web-embed component) acting on behalf of an interactive user.