# Identity Providers and OAuth Client Boundaries

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/identity-providers-and-oauth-client-boundaries*

Separate platform-user identity from API-client management, bind providers across business-group environments and API instances, and plan provider transitions, registration credentials and discovery.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Explain the relationships of Anypoint Platform, external Identity Providers (IdPs), AP Business Groups, and API clients in the context of OAuth 2.0.

## What the exam expects

- Distinguish platform users, API consumers and provider administration.
- Bind client providers to business-group environments and particular API instances.
- Predict which registrations and policies use an external provider.
- Plan changes without confusing defaults, environment removal and root deletion.
- Separate registration authentication, token introspection and grant discovery.

An **identity provider** authenticates an identity; a **client provider** manages API consumer registrations; **dynamic client registration** creates consumer clients through a provider endpoint; an **introspection client** authenticates token checks; an **Issuer** identifies the provider used for discovery ([Identity management](https://docs.mulesoft.com/access-management/external-identity), [OIDC client management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| User federation | Root identity-management configuration applies across business groups. | [Identity management](https://docs.mulesoft.com/access-management/external-identity) |
| Environment assignment | Business-group administrators assign providers and a default. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Registration location | Assigned external provider still creates the client with only Client ID Enforcement applied. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Policy endpoints | Deployed OAuth policies receive the selected IdP configuration. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Reassignment restrictions | Contracts, API Group membership and provider-type-changing related policies are blockers. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Existing APIs | A new environment default does not migrate their provider automatically. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Environment removal | Existing APIs and clients using that provider continue working. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Root deletion | Retained contracts do not prevent authorizing-policy failure after configuration deletion. | [Multiple providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) |
| Discovery refresh | Saving the configured provider refreshes grants when discovery is available. | [OIDC client management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task) |

## Check yourself

- Why must the documented client-maintenance PUT/DELETE examples not be assumed to work directly against an IdP?
- When adapting a maintenance request, how does its client_name map to the inbound application field?
- When can the portal's registration form select Refresh Token?

## Sources

- [Configure Multiple Client Providers for Client Management](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers)
- [Configuring OpenID Connect Client Management in Anypoint Platform](https://docs.mulesoft.com/access-management/configure-client-management-openid-task)
- [Configuring Identity Management in Anypoint Platform](https://docs.mulesoft.com/access-management/external-identity)
- [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams