# Credential for OAuth2

**URL:** <https://discuss.konghq.com/t/credential-for-oauth2/12711>\
**Category:** General\
**Tags:** kong-gateway\
**Created:** [June 4, 2024, 9:05am UTC](https://discuss.konghq.com/t/credential-for-oauth2/12711 "2024-06-04T09:05:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tim\_Yau](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/tim_yau/32/4509_2.png) [@Tim\_Yau](https://discuss.konghq.com/u/Tim_Yau)\
**Post date:** [June 4, 2024, 9:05am UTC](https://discuss.konghq.com/t/credential-for-oauth2/12711/1 "2024-06-04T09:05:36Z")

</div>

I use Kong gateway (DB-less mode) and building a custom plugin.  
Rather than storing OAuth2 credentials in plugin config, is it possible to store credentials in structure like basicauth\_credentials (existing or build a custom one)?

xxx\_credentials:

- consumer: client1  
clientid: clientid1  
clientsecret: client-secret  
url: [https://oauth2-server.company.com](https://oauth2-server.company.com)  
realm: realm

---

<div class="post-metadata">

**Author:** ![samugi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/samugi/32/4510_2.png) [@samugi](https://discuss.konghq.com/u/samugi)\
**Post date:** [June 5, 2024, 9:35am UTC](https://discuss.konghq.com/t/credential-for-oauth2/12711/2 "2024-06-05T09:35:04Z")

</div>

Hi @Tim_Yau, you should be able to achieve that by creating a [custom entity](https://docs.konghq.com/gateway/latest/plugin-development/custom-entities/), you can ignore the migration steps if you are only interested in running this dbless. You can then select your custom entities from the plugin’s code using for example: `local e = kong.db.<your_entity>:select_by_<field>(<value>)`, similarly to how basicauth\_credentials [are loaded](https://github.com/Kong/kong/blob/4adb6772a13e036f770ef6110c665e663db8cade/kong/plugins/basic-auth/access.lua#L91-L95).

I hope that helps.

---

<div class="post-metadata">

**Author:** ![boblewis](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/boblewis/32/4518_2.png) [@boblewis](https://discuss.konghq.com/u/boblewis)\
**Post date:** [June 18, 2024, 8:46am UTC](https://discuss.konghq.com/t/credential-for-oauth2/12711/3 "2024-06-18T08:46:55Z")

</div>

Hello

In Kong Gateway’s db-less mode, storing OAuth2 credentials directly in a custom plugin configuration isn’t advisable for security reasons. Instead, use Kong’s built-in OAuth2 plugin to manage credentials securely. Store OAuth2 credentials like client\_id and client\_secret in Kong’s consumers and oauth2\_credentials entities. This approach ensures proper security and alignment with Kong’s capabilities for OAuth2 credential management.

Thank you 🙂  
boblewis