Workfront App Client OAuth2 Machine to Machine Credentials returns 401 after Preview Refresh

[DennisBa1]

We have set up a Workfront  API App Client OAuth2 with Machine to Machine Credentials in our Preview environment. We use this to call /integrations/oauth2/api/v1/jwt/exchange route and authenticate our API integration. This worked fine last week but after the weekly refresh to our preview environment we are receiving this response.

{

    "statusCode": 401,

    "error": true,

    "type": "Unauthorized",

    "message": "Request failed with status code 401: You are not currently logged in."

}

The refresh did not delete the existing App, its just not being authorized.

We can create a new app, generate creds and get those to work BUT we don't want our integration to break every time a refresh occurs and go through the steps to recreate the app. Does anyone have any insight into why this is happening, can be prevented or another solution?

[skyehansen]

not quite sure how you are doing this but is it possible that whatever your credentials are, only exist in the sandbox? If so, it's working as intended (probably?). We usually generate credentials in the production environment and then wait until the refresh and the credentials show up in the sandbox after this.

[DennisBa1]

OK that's interesting. We are creating separate credentials in sandbox, preview and production. Each from different service accounts. We don't want our preview environment to have the same credentials as production because we don't want those credentials to have access to modify production resources. 

[skyehansen]

If I'm understanding you correctly, I think you will find that whichever service account you set up in production (last week) will now be in preview and whatever you have set up for authentication in production, will work in preview. (that's my guess)

[DennisBa1]

I don't think OAuth Apps and Client credentials are synchronized. For example, I just tested my prod API credentials are not authenticating to preview.

Nor do I want them to be. I don't think API credentials from a non-production environment should have access to a production environment - breaks least privilege best practices.