CXone client_credentials grant returning 401 in terraform local-exec

NICE CXone API & Integrations
1

My config is not working…

HTTP 401 Unauthorized

i’m trying to spin up a terraform local-exec that hits the CXone /api/v2/authorization/oauth2/token endpoint with a client_credentials grant. the json payload is just {"grant_type": "client_credentials", "client_id": "abc123", "client_secret": "xyz789"} and the org settings definitely match. curl requests don’t return a token, and the platform docs don’t mention any extra headers. still throwing the same 401 from my tokyo workstation.

2

It depends, but generally…

Error: 401 Unauthorized
The issue is likely the content-type header or how the secret is encoded. cxone expects application/x-www-form-urlencoded for the token endpoint, not json. sending a json body usually breaks the oauth handler.

try switching the request format. also, make sure the client secret isn’t url-encoded incorrectly in terraform. the provider handles auth differently than standard http requests.

use this payload structure instead:

{
 "grant_type": "client_credentials",
 "client_id": "abc123",
 "client_secret": "xyz789"
}

wait, that’s still json. my bad. you need form data.

grant_type=client_credentials&client_id=abc123&client_secret=xyz789

set the header to Content-Type: application/x-www-form-urlencoded. if that fails, check if the app registration has the correct scope. usually it’s urn:nice:cxone:platform:api. missing scopes cause 401s too.

3

gotcha is usually the Content-Type. As noted above, the CXone OAuth endpoint is strict about application/x-www-form-urlencoded. If you’re sending JSON, it fails silently or throws a 401 because the parser doesn’t find the expected keys.

Here’s a quick Go snippet that handles the encoding properly. You can adapt this for your Terraform script, or just test it locally to verify your credentials before wiring it into your infrastructure.

package main

import (
	"fmt"
	"net/http"
	"net/url"
	"strings"
)

func getAccessToken(clientID, clientSecret, env string) (string, error) {
	baseURL := fmt.Sprintf("https://%s.nice-cxone.com", env) // e.g., us-east-1
	tokenURL := fmt.Sprintf("%s/oauth/token", baseURL)

	data := url.Values{}
	data.Set("grant_type", "client_credentials")
	data.Set("client_id", clientID)
	data.Set("client_secret", clientSecret)

	req, err := http.NewRequest("POST", tokenURL, strings.NewReader(data.Encode()))
	if err != nil {
		return "", err
	}

	// This is the critical part. Many people forget this or set it to JSON
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("oauth error: %s", resp.Status)
	}

	// parse body for access_token...
	return "token", nil
}

If you’re doing this in Terraform, ensure the client_secret isn’t getting escaped weirdly by the provider. Sometimes the $ or special characters in secrets break the shell execution. I usually write the credentials to a temporary file and read them in to avoid shell injection issues. Also, double-check the client ID and secret are correctly configured within your CXone organization’s OAuth client settings.

1 Like
4

thanks for the hint about the content-type. switched the terraform local-exec to use --data-urlencode instead of posting json and it’s working now.

The CXone OAuth endpoint definitely needs application/x-www-form-urlencoded. Sending a JSON body was the blocker. Here’s the working curl command I used in the local-exec for reference. Double-check your org settings in CXone Admin for the client ID and secret.

resource "null_resource" "test_auth" {
 provisioner "local-exec" {
 command = <<EOT
 curl -X POST https://api.cxone.net/api/v2/authorization/oauth2/token \
 -H "Content-Type: application/x-www-form-urlencoded" \
 --data-urlencode "grant_type=client_credentials" \
 --data-urlencode "client_id=${var.cxone_client_id}" \
 --data-urlencode "client_secret=${var.cxone_client_secret}"
 EOT
 }
}

Good to go.

2 Likes
5

Switching to --data-urlencode is definitely the move here. The CXone OAuth endpoint is picky about that format, like a vending machine that only accepts exact change and rejects digital wallets.

If you’re keeping this in Terraform, just be careful with how you pass the secret. Terraform loves to escape characters in strings, and that can mess up the encoding if you’re not careful. It’s usually safer to put the credentials in a file or use a variable block rather than hardcoding them in the local-exec command. Keeps the logs cleaner too - important for GDPR Article 5 compliance regarding data minimisation.

One thing to watch out for is the token expiry. These client_credentials grant tokens don’t last forever. If your local-exec runs again later, you might hit a 401 just because the old token expired and you didn’t refresh it. This is a potential data protection risk, so ensure your automation accounts for token renewal.

1 Like