6

Lets say that we have an app (web/mobile/desktop) on witch the user never logins/registers but we still want to give him access to some resources, for example doing a POST /v1/users for example.

In order to do that POST the client needs an access_token. How does OAuth should work here? Or other authentication mechanism should be used?

alexm92
  • 386
  • 3
  • 15

2 Answers2

10

If your Web APIs (protected resource endpoints) don't care about who the accessing user is, in other words, if an access token presented to your Web APIs don't have to be associated with any user, implement Client Credentials Grant, which is one of the flows defined in RFC 6749, to issue such access tokens.

Community
  • 1
  • 1
Takahiko Kawasaki
  • 18,118
  • 9
  • 62
  • 105
  • web/mobile needs an access_token to exchange information with its apis/microservices. If the access_token is generated using **client_credentials_grant** (in the backend, not frontend), Would it be correct to use this token in the frontend side when by definition a [client token](https://auth0.com/docs/authorization/flows/call-your-api-using-the-client-credentials-flow) should be use only in the backend ? Thanks – JRichardsz Sep 22 '21 at 16:48
6

This answer applies to any type of authentication, OAuth or other.

The very nature of authentication is that the client holds a key which the server can verify and thereby allow access to protected resources. The client naturally keeps this key secret, else anyone can access protected resources belonging to them.

If your client has not registered in some way, there is no key. However, it is not necessary to have explicit registration/login. Your app can simply find some unique identifier and silently register with the server and receive an access token. The whole process is hidden from the user.

However, if your data is readily available, and anyone can access it, you may want to consider not using any authentication. If what you are asking is that you only want access from one particular app, then you need to include some form of shared access token from that app which the server can check. This is not 100% because anyone who can read code form your app or scan http traffic could in theory get that access token, but you can make it difficult for average users to do so. SSL helps greatly to secure this process.

Christian Cerri
  • 1,233
  • 2
  • 15
  • 19
  • 3
    Please be more accurate. OAuth2 distinguishes between client (=App) and Resource Owner (=User). The client can have an optional client secret, the resource owner normally has a password. – Bastian Voigt Dec 22 '16 at 10:43
  • client credential flow is the only way to get an access token without human user interaction. But, Would it be correct to use this token in the frontend side when by definition a [client token](https://auth0.com/docs/authorization/flows/call-your-api-using-the-client-credentials-flow) should be use only in the backend ? Thanks – JRichardsz Sep 22 '21 at 16:54