Given a company named X.

X has an OAuth 2 API available for its proprietary clients and also for 3rd party clients.

When a user P enters the process of authorizing a client, it is prompted with a window (right after authentication) showing several information (such as the application name, the scopes required, etc...) and must either click "confirm" or "cancel" to continue the process.

While having the user being able to confirm/deny authorization requests from 3rd party clients makes senses, does it still make sense to show this confirmation window for X's proprietary clients?

  • Is there something in the standard that forces to have this confirmation for every authorization request?
  • Is there a best practice in regards of that, that everyone agrees to?

1 Answer 1


If OAuth2 sever and clients are provided by company X and the user can see this, a consent question is not necessary. Such clients are also called first-party clients.

For all clients consent could be given only on first use and is then remembered by the oauth2 server. This way consent is requested only once per client and not for each subsequent authorization.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .