# OAuth2 Bearer Token Flow: Liferay Not Recognizing OAuth2 Incoming Assertion Configuration from Instance Settings

**URL:** <https://discuss.liferay.com/t/oauth2-bearer-token-flow-liferay-not-recognizing-oauth2-incoming-assertion-configuration-from-instance-settings/433>\
**Category:** Bug Reports\
**Created:** [March 18, 2026, 4:07pm UTC](https://discuss.liferay.com/t/oauth2-bearer-token-flow-liferay-not-recognizing-oauth2-incoming-assertion-configuration-from-instance-settings/433 "2026-03-18T16:07:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nishant.tankariya](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/nishant.tankariya/32/585_2.png) [@nishant.tankariya](https://discuss.liferay.com/u/nishant.tankariya)\
**Post date:** [March 18, 2026, 4:07pm UTC](https://discuss.liferay.com/t/oauth2-bearer-token-flow-liferay-not-recognizing-oauth2-incoming-assertion-configuration-from-instance-settings/433/1 "2026-03-18T16:07:01Z")

</div>

## Description

I observed an issue with the OAuth 2 Bearer Token flow in Liferay where the **OAuth2 Incoming Assertion Configuration** defined in **Instance Settings** is not being picked up during access token generation.

When the same configuration is saved under **System Settings** , the access token generation works as expected. However, when configured at the **Instance Settings level** , Liferay fails to resolve the configuration and throws the following error:

`No JWS signature keys for issuer: http://keycloak:8080/realms/liferay, in company: 56453292236465`

## Investigation

After investigating the issue, I reviewed the Liferay source code responsible for generating the access token, specifically in the handler:

- `LiferayJWTBearerGrantHandler`

It appears that the **scoped configuration was not being considered** , which prevents Liferay from resolving the **instance-level OAuth2 Incoming Assertion configuration**.

## Proposed Fix

To address this, I added scoped configuration support when the `OAuth2InAssertionManagedServiceFactory` service is registered.

The following configuration identifiers were included:

```java
new String[] {
	"com.liferay.oauth2.provider.rest.internal.configuration." +
		"OAuth2InAssertionConfiguration",
	"com.liferay.oauth2.provider.rest.internal.configuration." +
		"OAuth2InAssertionConfiguration" +
			".scoped"
}

```

---

<div class="post-metadata">

**Author:** ![Allison\_McGill](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/allison_mcgill/32/125_2.png) [@Allison\_McGill](https://discuss.liferay.com/u/Allison_McGill)\
**Post date:** [May 21, 2026, 1:41am UTC](https://discuss.liferay.com/t/oauth2-bearer-token-flow-liferay-not-recognizing-oauth2-incoming-assertion-configuration-from-instance-settings/433/2 "2026-05-21T01:41:08Z")

</div>

Hi @nishant.tankariya What version of Liferay were you using where you could reproduce this issue?

---

<div class="post-metadata">

**Author:** ![nishant.tankariya](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/nishant.tankariya/32/585_2.png) [@nishant.tankariya](https://discuss.liferay.com/u/nishant.tankariya)\
**Post date:** [May 21, 2026, 6:22am UTC](https://discuss.liferay.com/t/oauth2-bearer-token-flow-liferay-not-recognizing-oauth2-incoming-assertion-configuration-from-instance-settings/433/3 "2026-05-21T06:22:11Z")

</div>

Hello @Allison_McGill, I’ve used Liferay DXP `2026.Q1.0-LTS`. But I’m still facing the issue in latest Liferay version