Page Comparison

Implicit grant type is used to obtain access tokens if your application (client) is a mobile application or a browser based app such as a JavaScript client. Similar to authorization code grant, the implicit grant type is also based in on redirection flow but the . The redirection URI includes the access token in the URI fragment. Therefore, the client application is capable of interacting with the resource owner user agent to obtain the access token from the redirection URI which is sent from the authorization server.

The implicit grant type does not require client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. The resource owner needs to authenticate with is authenticated by the authorization server to obtain the access token. Because the The access token is encoded into the redirection URI, it . This may be exposed to the resource owner and other applications residing in inside the same device.

The diagram below depicts the flow of Implicit Grant.

Image RemovedImage Added

1. The client requests for the access token with the client ID and grant type, with and other optional parameters.

2. Since the resource owner authenticates directly with the authorization server, his/her their credentials will not be shared with the client.

3. The Authorization Server sends the Access access token through a URI fragment to the client.

4. The client extracts the token from the fragment and sends the API request to the Resource Server with the access token.

The following parameters are required to implement the Implicit grant type in WSO2 API Manager.

An example is given below : 

https://localhost:8243/authorize
scope=openid
&response_type=id_token
&redirect_uri=http://localhost:8080/playground2/oauth2client
&nonce=13e2312637dg136e1
&client_id=mzdQQ0RZOIqAf549ucIImB4h0SIa

Invoking the Token API to generate tokens  

In this example we use the WSO2 Playground, which is hosted as a web application, to obtain the access token with implicit grant.

...

1. Login to WSO2 API Manager Store and create an application as shown below.
   Image RemovedImage Added

2. Go to production the Production keys tab in for the created application, . Add http://localhost:8080/playground2/oauth2client as the callback URL the Callback URL. Select Implicit from the list of grant types and click Generate Keys. 

   Note
   Make sure you have select implicit from the Grant Types before generating keys.

   Image Removed

   The Implicit grant and Code grant type checkboxes are disabled by default in the UI. To enable selecting the checkboxes, enter the Callback URL for the application.

   Image Added

3. Go to playground app http://wso2is.local:8080/playground2/index.jsp and click click import photos.
   Image RemovedImage Added
   

4. Give the information in the table below and click Authorize.

   Field	Sample Value
   Authorization Grant Type	Implicit
   Client Id	Consumer Key obtained for your application
   Scope	The scope you have selected for you application
   Callback URL	The callback URL of your application
   Authorize Endpoint	https://localhost:9443/oauth28243/authorize

   Image RemovedImage Added

5. The playground application redirects to the login page. Enter you username and password and click Sign In.

   

6. Click Approve to provide access to your information.
   

   

7. You will receive the access token as follows 

   Image Modified