Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the client_id and make same request easily. Public clients like mobile app or web app can't guarantee of that is confidential client.

I really want to know how public clients solve this. Such as Facebook mobile app and Google Inbox. They implemented authentication way for themsevles? Drop out OAuth 2.0?


In short:
client_id and client_secret are used for to authenticate the APP.
username and password are used for to authenticate the user.

It also means double layer protection.

The specification says:

the client MUST authenticate with the authorization server as described in Section 3.2.1.

A client authentication is done by using a client_id and a client_secret value.

Actually the latest paragraph of the section 3.2.1 says

A public client that was not issued a client password MAY use the client_id request parameter to identify itself when sending requests to the token endpoint (e.g. for the purpose of providing end-user context, client usage statistics).

However, it just may. But Google gives a client_id and a client_secret on the developer console when trying to use an API.

If you want to use Resource Owner Password Credentials for an API or a Web authorization you might provide a register page to your clients to register themselves. (I recommend using of Client Credentials flow for API)

If you want to use Resource Owner Password Credentials for a mobile app you might give a standart client_id like AwesomeAPP and a client_secret like Bl**123_Blabla.

Or you may use AwesomeAPP_v1.0 as client_id to track that how many people use which version of the App although it's not the best way. But you may.

Hope this helps...

  • I was just confused. clientID and clientPassword shouldn't be in public clients... Anyway Thank you! – BaHwan Han Jul 22 '16 at 14:32
  • I had thought just like you and I agree with you about public clients. However, if we talk about a mobile app client_id and client_secret values will be compiled in the app. Also it had taken my time a lot because of client registration works, learning OAuth 2.0 flows and PassportJS etc. Good luck... – efkan Jul 22 '16 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.