Repository navigation
Choose the grant type and add the client credentials grant - #13
Merged
Merged
Conversation
The preview field takes a function that builds the request. It shows a GET request with its query string, and a POST request with its headers and body.
The tokens page has a grant type selector, grouped by kind. Each grant type has its own form, with a live preview of its request. A grant type the provider does not advertise can still be used, with a warning. The client credentials grant gets tokens for the client itself, without any user. Repeated extra parameters, like several resource values, are all sent. The third setup step is now called Tokens, and the session pages move from /session to /tokens: request, current and logout. Client tokens have no logout tab, but a button to forget them.
azmeuk
force-pushed
the
feat/client-credentials
branch
from
November 5, 2026 23:27
d78f5c2 to
07ddb7c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The tokens page now has a grant type selector. Each grant type has its own form, with a live preview of its request. A grant type the provider does not advertise can still be used, with a warning.
The first new grant is client credentials. It gets tokens for the client itself, without any user. A public client gets a warning, since this grant is meant for confidential clients. Dynamic registration can now request this grant.
The last setup step is now called Tokens, because not every flow has a user session. The pages move from /session to /tokens/request, /tokens/current and /tokens/logout. Client tokens have no logout tab, but a button to forget them.
Authlib keeps only the last value of a repeated token request parameter, such as several resource values. A small client subclass works around this until it is fixed upstream.
Part of #2