Configure an OAuth Client

Using Database Actions with OAuth 2.0-based authentication, you can ensure that your Autonomous AI Vector Database is accessed only by specific users or clients.

OAuth 2.0 is a standard Internet protocol that defines flows to provide conditional and limited access to a RESTful API. For more information, see OAuth-Based Authentication in Oracle REST Data Services Developer's Guide.

To navigate to the OAuth Clients page, first navigate to the Development tab in Database Actions and then select REST. To create an OAuth client, see the following steps:

1. In the OAuth Clients page, select Create OAuth Client.
2. Enter the following fields. The fields with an asterisk (*) are mandatory:

   Client Definition tab

   • Owner: This is a read only field that should be your Vector Database user.
   • Grant type: Select the authorization grant type. In this case, for a client associated with a vector database, select CLIENT_CRED from the drop down menu. For information about the available grant types, see OAuth Flows in Oracle REST Data Services Developer's Guide.
   • Name: Name of the client.
   • Description: Description of the purpose of the client.
   • Support Email: Enter the email where end users can contact the client for support.
   • (Optional) Support URI: Enter the URI where end users can contact the client for support. Example: http:// www.myclientdomain.com/support/

   Show code: Select this option to view the PL/SQL code equivalent of the Create OAuth Client panel. You can copy and execute this PL/SQL code in the worksheet to perform the same action that occurs when you click Create in the Create OAuth Client panel.

3. Select roles that should be associated with the client.
   Navigate to the Roles tab, select oracle.dbtools.auth.roles.builtin.VecDB from the available roles, and click the single right arrow to assign it to the new client.
4. Click Create.

   The OAuth Client registered is displayed on the OAuth Clients page.

   A preview of the client secret is displayed. Copy the secret value as this is the only instance when it is shown. If you forget the client secret, you can use the Rotate Secret action to change it. See Managing Secrets in Using Oracle AI Database Actions.

   The Client ID value represents the secret credential for the OAuth client. Click Show/Hide to see the values.

   Test the secured REST service endpoint using a REST client or the cURL command line tool.

   For more general, non-Vector Database specific information about managing OAuth clients using Database Actions, see Managing OAuth Clients in Using Oracle AI Database Actions.

5. Use the client ID and client secret to request an OAuth token.

   Use the following curl command, with values replaced with your own input:

   curl -i -k --user <client_id>:<client_secret> --data "grant_type=client_credentials" https://example.com/ords/vecdb_user/oauth/token

   The access token returned can be used to make requests to an Autonomous AI Vector Database endpoint. For example, you can make a request to the summary endpoint to find the number of tables, vectors, and models you have in your Vector Database, as in the following:

   curl --location 'https://example.com/ords/vecdb_user/_/db-api/stable/vecdb/summary' \
   --header 'Authorization: Bearer <access_token>'