feat: add OAuth 2.0 Client Credentials support for Credly by luisfelipec95 · Pull Request #3002 · openedx/credentials

luisfelipec95 · 2026-08-14T21:48:40Z

Description

This PR adds support for OAuth 2.0 (Client Credentials Grant) authentication for the Credly integration in edx-credentials.

Previously, Credly relied solely on legacy API Keys (Basic Auth). This update enables modern OAuth 2.0 authentication while maintaining full backward compatibility with existing legacy organizations.

Key Changes

1. Database & Models (`credentials/apps/badges/models.py`)

Added oauth_client_id and oauth_client_secret fields to CredlyOrganization.
Generated and applied database migrations.

2. API Client (`credentials/apps/badges/credly/api_client.py`)

Added _get_oauth_token() method to handle the OAuth 2.0 token exchange at /oauth/token.
Implemented Django cache storage for access tokens to prevent unnecessary HTTP requests during token lifespan.
Configured dynamic header resolution in _get_headers(): uses Authorization: Bearer <token> when OAuth credentials are provided, falling back to Authorization: Basic <legacy_key>.
Requested badge_templates issued_badges scopes to cover both badge template syncing and badge issuance operations.

3. Django Admin Interface & Forms (`admin.py` & `admin_forms.py`)

Reorganized CredlyOrganizationAdmin using fieldsets to clearly separate OAuth 2.0 Credentials from Legacy API Key Authentication.
Updated CredlyOrganizationAdminForm.clean() and ensure_organization_exists() to validate OAuth credentials via fetch_badge_templates() (since Credly restricts GET /v1/organizations/{id} under Bearer auth).

How to Test

OAuth 2.0 Credentials Flow:
- Go to Django Admin -> Credly Organizations -> Add Organization.
- Fill in UUID, Oauth Client ID, and Oauth Client Secret (leave API Key blank).
- Save the organization. Verify that it validates credentials and saves successfully.
- Run the action Sync organization badge templates and ensure templates are fetched without error.
Error Handling Check:
- Enter invalid Client Secret or Client ID.
- Submit the form. Verify that a clear validation error message appears at the top of the form instead of a 500 error page.
Backward Compatibility Check:
- Create or edit an organization using only the Legacy API Key.
- Verify that saving and syncing badge templates still works as expected.

openedx-webhooks · 2026-08-14T21:48:45Z

Thanks for the pull request, @luisfelipec95!

This repository is currently maintained by @jajjibhai008.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

mphilbrick211 · 2026-08-19T20:02:22Z

Hi @luisfelipec95! Just flagging some failing tests here.

GlugovGrGlib · 2026-09-09T22:11:18Z

+        max_length=255,
+        blank=True,
+        null=True,
+        help_text=_("OAuth 2.0 Client ID for Credly Organization.")


Please regenerate .po files with the newly added strings, so lint job can pass successfully.

GlugovGrGlib · 2026-09-09T22:24:19Z


            self.assertEqual(
                str(cm.exception),
                '["You can\'t provide an API key for a configured organization."]',


The message is different from the one in admin_forms.py, please update

GlugovGrGlib · 2026-09-09T22:25:58Z

        ) as mock_get_orgs:
            mock_get_orgs.return_value = {"test_uuid": "test_org"}

            with self.assertRaises(BadgeProviderError) as cm:


It's necessary to update exception to forms.ValidationError

GlugovGrGlib · 2026-09-09T22:32:24Z


    def test_ensure_organization_exists(self):
        form = CredlyOrganizationAdminForm()
        api_client = MagicMock()


This and a test below should use api_client with oauth attributes unset (api_client.oauth_client_id = None and api_client.oauth_client_secret = None), so these tests will exercise API token branch

Also it's necessary to add tests that will exercise the new OAuth code branch

GlugovGrGlib

Thanks for the PR, I left some suggestions for improvements, as well as suggestions on how to fix CI failures. Please cover as well new oauth logic with tests similarly to api token logic.

GlugovGrGlib · 2026-09-09T22:33:31Z


    def test_ensure_organization_exists(self):
        form = CredlyOrganizationAdminForm()
        api_client = MagicMock()


Also it's necessary to add tests that will exercise the new OAuth code branch

GlugovGrGlib · 2026-09-09T22:43:49Z

@@ -6,6 +6,7 @@

 import requests  # pylint: disable=unused-import


nit: unused import directive can be removed now

GlugovGrGlib · 2026-09-09T22:53:25Z


 import requests  # pylint: disable=unused-import
 from attrs import asdict
+from django.core.cache import cache


please sort imports alphabetically, so this new import goes after from django.contrib.sites.models import Site

GlugovGrGlib · 2026-09-09T22:57:28Z

+    oauth_client_id = models.CharField(
+        max_length=255,
+        blank=True,
+        null=True,


Avoid null=True for field with blank=True for this field and a field below

GlugovGrGlib · 2026-09-09T23:03:51Z

+                    self.api_data = org_data
+
+        except (CredlyError, BadgeProviderError) as exc:
+            if "401" in str(exc) or "Unauthorized" in str(exc):


just 401 might match some other number in exception not specifically status code. Because in exception message status code is wrapped in Status() it's better to check for if "Status(401)" in str(exc) ...

GlugovGrGlib · 2026-09-09T23:07:22Z

+                expires_in = data.get("expires_in", 7200)
+
+                if not token:
+                    raise CredlyError(f"Credly response did not contain access_token: {data}")


This type of exception is not handled in https://github.com/openedx/credentials/blob/master/credentials/apps/badges/issuers.py#L162 nor in revocation method https://github.com/openedx/credentials/blob/master/credentials/apps/badges/issuers.py#L183.
I suggest extending methods in issuers.py to handle CredlyError exception class in addition to BadgeProviderError

github-project-automation Bot added this to Aperture-Maintained Aug 14, 2026

openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Aug 14, 2026

openedx-webhooks added this to Contributions Aug 14, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Aug 14, 2026

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Aug 19, 2026

GlugovGrGlib self-requested a review August 26, 2026 12:59

luisfelipec95 removed the request for review from GlugovGrGlib September 2, 2026 23:02

luisfelipec95 force-pushed the lfc/support-oauth-2 branch from 7db1a49 to 19dc9b8 Compare September 3, 2026 21:54

feat: add OAuth 2.0 Client Credentials support for Credly

4219d5f

luisfelipec95 force-pushed the lfc/support-oauth-2 branch from 4b87a0d to 4219d5f Compare September 4, 2026 04:36

GlugovGrGlib reviewed Sep 9, 2026

View reviewed changes

GlugovGrGlib requested changes Sep 9, 2026

View reviewed changes

		@@ -6,6 +6,7 @@

		import requests # pylint: disable=unused-import

Uh oh!

Conversation

luisfelipec95 commented Aug 14, 2026

Description

Key Changes

1. Database & Models (credentials/apps/badges/models.py)

2. API Client (credentials/apps/badges/credly/api_client.py)

3. Django Admin Interface & Forms (admin.py & admin_forms.py)

How to Test

Uh oh!

openedx-webhooks commented Aug 14, 2026

Uh oh!

mphilbrick211 commented Aug 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

GlugovGrGlib left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

1. Database & Models (`credentials/apps/badges/models.py`)

2. API Client (`credentials/apps/badges/credly/api_client.py`)

3. Django Admin Interface & Forms (`admin.py` & `admin_forms.py`)