Headless CI/CD integration requires an authentication mechanism that operates independently of interactive user sessions. UiPath supports this architecture through confidential external OAuth applications configured with application scopes.

Option B is correct because confidential applications can authenticate using the OAuth 2.0 client credentials grant.

In this configuration, administrators register an external application and assign the application scopes required to access specific UiPath services.

The registration provides a client identifier and client secret. Azure DevOps can securely store these credentials using protected pipeline variables or an appropriate secrets-management service.

During pipeline execution, the automation requests an access token from the UiPath identity service using the client credentials flow. The resulting token represents the application identity rather than an individual user.

This approach supports unattended build, deployment, and testing operations without browser-based authentication or developer interaction.

Option A requires interactive authentication. Option C relies on user scopes, which require user-context authorization. Option D incorrectly assumes that a public application and repository connection provide independent service authentication.

For production implementation, administrators should apply least-privilege scopes, protect client secrets, manage credential rotation, and ensure that the external application has the necessary resource-level permissions.

Official UiPath Reference(s): Automation Cloud Admin Guide — Managing external OAuth applications; Orchestrator User Guide — Authenticating with an external application.