topic Re: Does Splunk supports OAuth for REST API ? in Splunk Dev

Does Splunk supports OAuth for REST API ?

vallabhk — Wed, 19 Jan 2022 16:47:46 GMT

Could you help us in confirming whether Splunk REST APIs supports OAuth authentication apart from the existing basic authentication(username/password) and authentication tokens(link). ? We see a lot of customers enquiring about it.

Also, is it mandatory to always use an authentication token mechanism for a service account in Splunk or can we use a username/password as well ?

@sloshburch

Re: Does Splunk supports OAuth for REST API ?

murenkot — Sun, 23 Jan 2022 21:08:16 GMT

Splunk REST APIs don't support OAuth authentication. But maybe this solution with a web server or LDAP will help you: https://community.splunk.com/t5/Security/Does-Splunk-support-oAuth-2-0-single-sign-on/m-p/292745/highlight/true#M7832

You can use a username/password for a Service Account but you'll need to give the Service Account access to read the information you want Splunk to be able to collect/access. It only needs read rights.

You can find examples of how to use username/password in requests here: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing

or you can use authentification with Python script and use a session key in your requests: https://docs.splunk.com/Documentation/Splunk/8.2.4/RESTTUT/RESTsearches

Re: Does Splunk supports OAuth for REST API ?

xpac — Fri, 23 Jan 2026 12:04:52 GMT

Just updating this, because it's still a top search result.

At least for general auth, it seems this has changed with the 10.2. release 🙂

https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/configure-the-splunk-platform-with-external-authentication-and-authorization/configure-an-external-open-authorization-2.0-authorization-server

No mention of direct REST API requests yet, but that might be a step in the direction...