CODEWITHSUNDEEP
authenticationoauth-2.0passwordsauthorizationclientid
Mike
Mike

Reputation: 663

Why do I need a client id for OAuth2 password grant flow?

Example: 

POST /oauth/token HTTP/1.1
Host: authorization-server.com
Content-type: application/x-www-form-urlencoded

grant_type=password
&username=exampleuser
&password=1234luggage
&client_id=xxxxxxxxxx

Why do I need a client id for OAuth2 password grant flow? Why is username and password not enough?

Upvotes: 2

Views: 816

Answers (1)

Takahiko Kawasaki
Takahiko Kawasaki

Reputation: 18991

The token endpoint will issue an access token. The access token denotes "Who grants what permissions to whom."

  • Who here is the user who is identified by username.
  • what permissions here are scopes listed in a scope request parameter (although your example does not include the scope request parameter).
  • whom here is a client application.

For the authorization server to know whom (i.e. a client application), you need to include a client_id request parameter.

Upvotes: 3

Related Questions