Hi,

The issue is with the client secret. In your screenshot, it’s already encoded. You only need to encode the secret when using it directly inside your ODC applications. In Postman, you should paste the raw client secret and let Postman handle the encoding automatically. That should resolve the issue. 

Hi Saket,
In ODC, the recommended way to obtain an access token for the public ODC REST APIs is to first call the Discovery document and then use the token_endpoint returned there. If you hardcode a realm-based Keycloak URL (e.g., /auth/realms/.../protocol/openid-connect/token) you can easily end up hitting the wrong authorization server/realm for your tenant, which typically results in 401 with invalid_client.

Per the official ODC documentation, the steps are:

1. Call the discovery endpoint

   • curl -X GET "https:///identity/.well-known/openid-configuration" \

       -H "accept: application/json"

2. From the JSON response, copy the token_endpoint value.
3. Call that token_endpoint with client credentials:
   • curl -X POST "" \

       -H "Content-Type: application/x-www-form-urlencoded" \

       -d "grant_type=client_credentials&client_id=&client_secret="

If you’re calling the token endpoint from an OutSystems app, OutSystems also recommends URL-encoding the client secret (e.g., EncodeURL(Settings.ClientSecret)). 

So, I’d suggest:

• Make sure you are using the token_endpoint from .../identity/.well-known/openid-configuration (not a manually constructed realm URL),
• Ensure the client_id/client_secret are copied from the same ODC tenant/environment you’re targeting,
• URL-encode the secret if you’re building the request in OutSystems. 

I hope, this information can help you.

Best, Miguel

I tried integrating external CI/CD with our ODC Free account using the API Client and client credentials, but it does not work.

Even with:

• Correct client_id and client_secret

• With or without encoding via postman

Is getting access token working in free account.

In your screenshot you are requesting the tokens from the wrong realm.

1. Step: Lookup the token endpoint from your portal realm using

https://personal-thdyfzp8.outsystems.dev/identity/.well-known/openid-configuration
This returns an OpenID discovery document. Lookup the value for "token_endpoint" that should look like this:

https://personal-thdyfzp8.outsystems.dev /auth/realms/<UUID>/protocol/openid-connect/token

2. Step: Client credentials flow

Looking at your screenshot this looks good. Change the Url to your portal realm token endpoint and you should be good to go.

Best,

Stefan

I am using the exact token_endpoint returned by /identity/.well-known/openid-configuration (as shown in the screenshot).

Even with:

• Correct client_id and client_secret

• Calling the token endpoint from Postman

• Trying both with encoding and without encoding of the client secret

The request always returns:

invalid_client

The solution is working

Thanks