SAML SSO conflict with OAuth token generation for WFM scripts

Hey everyone,

I’m trying to figure out the right way to handle API authentication for some Python scripts that pull WFM adherence data. We recently switched our org to SAML SSO for human users, and now my old OAuth client credentials flow is breaking.

The scripts run on a server, so there’s no user interaction to trigger the SAML login redirect. I tried creating a new OAuth token with the analytics:read scope, but when I use it to hit /api/v2/analytics/agents/realtime/intervals, I get a 401 Unauthorized error. The response body just says "error_description": "Invalid or expired token".

Here is the basic auth request I’m sending:

import requests

url = "https://{{my_env}}.mypurecloud.com/oauth/token"
auth = requests.auth.HTTPBasicAuth('my_client_id', 'my_client_secret')
data = {'grant_type': 'client_credentials', 'scope': 'analytics:read'}
headers = {'Content-Type': 'application/x-www-form-urlencoded'}

r = requests.post(url, auth=auth, data=data, headers=headers)
print(r.json())

The token generation itself works fine and returns an access_token. It’s only when I use that token for the actual API calls that it fails. I read somewhere that SAML SSO might disable standard OAuth for certain scopes, but that seems odd for programmatic access.

Do I need to set up a specific user account that bypasses SSO? Or is there a different grant type I should be using? I’ve been stuck on this for a couple of days. Any pointers would be great.

SAML shouldn’t actually break the client credentials flow. Those are two different authentication mechanisms. SAML is for users logging into the UI. Client credentials are for server-to-server apps. If your scripts are failing, it’s usually because the OAuth client you’re using doesn’t have the right scopes or it’s been disabled in the admin console.

Check the OAuth client settings. Go to Admin > Security > OAuth Clients. Find the client your script uses. Make sure Client Credentials Grant is checked. Also, verify the scopes. analytics:read is good for adherence, but sometimes you need wfm:read depending on the exact endpoint.

Here is a quick curl to test the token generation directly. If this fails, the issue is with the client config, not SAML.

curl -X POST "https://api.mypurecloud.com/api/v2/oauth/token" \
 -H "Content-Type: application/x-www-form-urlencoded" \
 -H "Authorization: Basic <base64(client_id:client_secret)>" \
 -d "grant_type=client_credentials&scope=analytics:read"

If that returns a 200, your token generation is fine. The issue is likely in how the Python script is passing the token or the scope validation on the specific WFM endpoint. Paste the exact error code you’re getting from the API call, not the token request.