Creating the PKCE Grant Client - Creating the PKCE Grant Client - OnBase - Other - Hyland for Workday HCM - Other/Hyland-for-Workday-HCM/2.0/Hyland-for-Workday-HCM/Configuration/System-Configuration/Configuring-Workday-with-Identity-Providers/Configuring-Hyland-Identity-and-Access-Management-IAM-Clients/Creating-the-PKCE-Grant-Client - 2.0 - 2.0

Hyland for Workday HCM
Platform
Other
Product
Hyland for Workday HCM
Release
2.0
License
ft:lastPublication
2026-08-27T22:38:01.171000
ft:locale
en-US
Create and configure a Client Connection in Hyland IdP for versions earlier than 5.0, or in Hyland IdS for version 5.0 and later.
Note: For details, refer to the Identity and Access Management Services documentation.

  • If you are using version 5.0 and later, see Configuring a Client Connection on Hyland IdS.

  • If you are using earlier versions, see Configuring a Client Connection on the Hyland IdP Server.

To create the PKCE ((Proof Key for Code Exchange) client in the Hyland IAM service application:

Note: The client is historically named PKCE Grant Client. Although it is used for HCMIS-BE authentication and token-exchange scenarios that differ from a typical browser-based PKCE implementation, the client must be configured with the PKCE settings described in this procedure, including Require PKCE and Allow PKCE with a plaintext code challenge.
  1. In the IAM service application, create a new client with the following settings:
    Setting Value
    Client Name Enter PKCE Grant Client.
    Client Description Enter Client for PKCE Flow.
    Protocol Type Enter oidc.
    Redirect URLs Enter

    https://<CPEInstance>.hylandcloud.com/<QAVirtualPath>/view/<CPEInstance>.hylandcloud.com/authentication-confirmation

    where

    • <CPEInstance> is the customer and environment-specific CPE (Hyland Cloud Platform Engineering) instance name used as the hylandcloud.com subdomain. For example, cpeinstancename.

    • <QAVVirtualPath> is the virtual path of the Quick Access Viewer deployment. For example, 178QA
    Allowed Grant Types Select the following:
    • Authorization Code
    • Password
    • Token Exchange
    Allowed Scopes openid evolution group hc.config.read hc.config.write
    Allow users to log in locally Deselect this option.
    Require PKCE Select this option.
    Allow PKCE with a plain-text code challenge Select this option.
    Post Logout Redirect URLs

    To add a new URL to the list, type the URL in the field and press Enter. The URL must use the format: format: https://<CPEInstance>.hylandcloud.com/identityservice/<CPEInstance>.hylandcloud.com

    where <CPEInstance> is the customer-and environment-specific Hyland Cloud Platform Engineering (CPE) instance name used as the hylandcloud.com subdomain. For example, cpeinstancename

  2. Select Client Secret must be present
  3. Add a Client Secret.
    Note: For details, see the Configuring Client Secrets chapter in the Identity and Access Management Services documentation. Refer to the documentation version that corresponds to the IAM version you are using.
  4. Click Save in the lower right corner of the page.
  5. Recycle the application pool of the Hyland IdP server/IdS in IIS for the changes to take effect.