I used a global variable (DistributedMapCacheClientService & DistributedMapCacheServer) and a separate process group to run each 2 min to get a token then store that token in my global variable and use it in the header of my OnBoard API and each time i get a 403 error I loopback my flow file to request new token to use

UpdateAttribute before the InvokeHTTP is used to get the exact token text from the full response from the oauth API