A developer has imported an OpenAPI spec that defines an oauth2 security scheme using the client credentials flow. The spec references a token URL and required scopes. What must the developer do next in the watsonx Assistant UI to finish the authentication configuration?

After importing an OpenAPI spec with an oauth2 clientCredentials security scheme, watsonx Assistant recognizes the scheme type and prompts the developer to enter the client ID and client secret in the extension authentication panel. The assistant then handles token acquisition, caching, and refresh automatically — no manual token management in dialog nodes is required. The correct answer, "Supply the client ID, client secret, and confirm the token URL in the extension's authentication settings panel", directly satisfies the scenario because it aligns with watsonx Assistant's design principles and the specific capability being tested. The incorrect options ("Manually add a Bearer token header to every dialog node that calls the extension", "Encode the client credentials in Base64 and paste them into the servers URL", "Create a separate Cloud Function to obtain tokens and inject them as context variables") may appear relevant but each misses a key requirement or introduces a step that is either unnecessary or belongs to a different workflow. Mastering the distinction between these approaches is essential for effective watsonx Assistant implementations and is a core focus of the Domain 6: Build Back-End Integrations section of the certification exam.