Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches.
Our specifications are:
- Secure a REST API.
- Own apps and websites connect to our API.
- Users access our services without credentials.
- Currently our API is private but possibly making it public in the future.
From the research I have done, I think I should be using oAuth 2.0 (Two-Legged) authentication with "Client Credentials" grant type.
I'm worried though that I may be misunderstanding the process, as it would seem that under this method all that is required is sending through your ConsumerId and ConsumerSecret. Whereas, the OAuth 1.0 method requires a HashKey, ConsumerKey, Nonce etc.
In Summary, my questions are:
- Is the oAuth 2.0 (Two-Legged) using "Client Credentials" the best approach for me to take.
- Is the auth flow as simple as sending your ClientId and ClientSecret and getting back your bearer token.
Thanks in advance
Sources I used for oAuth 2.0 (Two-Legged)