---
title: Configuring an OAuth Token Processor instance
description: The PingFederate STS provides validation for OAuth 2.0 bearer tokens. To use the OAuth Token Processor, you must first configure an Access Token Management (ATM) instance.
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:pf_config_oauth_token_process_instance
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_config_oauth_token_process_instance.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 5, 2022
section_ids:
  about-this-task: About this task
  steps: Steps
  result: Result:
  result-2: Result:
---

# Configuring an OAuth Token Processor instance

The PingFederate STS provides validation for OAuth 2.0 bearer tokens. To use the OAuth Token Processor, you must first configure an Access Token Management (ATM) instance.

## About this task

For more information about PingFederate OAuth authorization server and access token management, see [About OAuth](../introduction_to_pingfederate/pf_about_oauth.html) and [Access token management](pf_access_token_management.html).

## Steps

1. Go to **Authentication > Token Exchange > Token Processors**.

2. On the **Instance Configuration** tab, configure the basics of the token processor instance.

   1. In the **Access Token Manager** row, from the **Field Value** list, select an ATM instance.

      If the desired ATM instance is not shown, click **Manage Access Token Manager**.

      ### Result:

      The token processor instance uses the selected ATM instance to validate the OAuth bearer access tokens.

   2. (Optional) Select the **Scope Value as Single String** checkbox.

      ### Result:

   If selected, the scope value is returned as a single space-delimited set of string value. If it is not selected, scope values are returned as a multivalued attribute.