Implicit Grant

Implicit grant type is used to obtain access tokens if your application (client) is a mobile application or a browser based app such as a JavaScript client. Similar to authorization code grant, implicit grant type is also based in redirection flow but the redirection URI includes the access token in the URI fragment. Therefore, the client application is capable of interacting with the resource owner user agent to obtain the access token from the redirection URI which is sent from the authorization server.

The implicit grant type does not require client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. The resource owner needs to authenticate with the authorization server to obtain the access token. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing in the same device.

The diagram below depicts the flow of Implicit Grant.

The client requests for the access token with the client ID and grant type, with optional parameters.
Since the resource owner authenticates directly with the authorization server, his/her credentials will not be shared with the client.
The Authorization Server sends the Access token through a URI fragment to the client.
The client extracts the token from the fragment and sends the API request to the Resource Server with the access token.

The refresh token will not be issued for the client with this grant, as the client type is public. Also note that, the implicit grant does not include client authentication because it does not make use of client secret.

The following parameters are required to implement the Implicit grant type in WSO2 API Manager.

Name	Description	Sample value
`scope`	The OAuth scope you are requesting for the particular token	`openid`
`response_type`	The required response format	`id_token`
`redirect_uri`	The URL of the Oauth application requesting for the token	`http://localhost:8080/playground2/oauth2client`
`nonce`	Any random value	`13e2312637dg136e1`
`client_id`	Client ID of the OAuth application	`mzdQQ0RZOIqAf549ucIImB4h0SIa`

An example is given below :

https://localhost:8243/authorize
scope=openid
&response_type=id_token
&redirect_uri=http://localhost:8080/playground2/oauth2client
&nonce=13e2312637dg136e1
&client_id=mzdQQ0RZOIqAf549ucIImB4h0SIa

Invoking the Token API to generate tokens

In this example we use the WSO2 Playground, which hosted as a web application to obtain the access token with implicit grant.

Before you begin,

The following instructions use the sample playground webapp. For instructions on how to set up the sample webapp, see Setting up the Sample Webapp.

Login to WSO2 API Manager Store and create an application as below.
Go to production keys tab in the created application, Add http://localhost:8080/playground2/oauth2client as the callback URL, select implicit form the grant type list and click Generate Keys.

By default the implicit and code grant type selection checkboxes are disabled in the UI. You need to enter the callback URL first to enable selecting the implicit grant type.
Go to playground app http://wso2is.local:8080/playground2/index.jsp and click import photos.

Give the information in the table below and click Authorize.

Field	Sample Value
Authorization Grant Type	Implicit
Client Id	Consumer Key obtained for your application
Scope	The scope you have selected for you application
Callback URL	The callback URL of your application
Authorize Endpoint	`https://localhost:8243/authorize`

The playground application redirects to the login page. Enter you username and password and click Sign In.
Click Approve to provide access to your information.
You will receive the access token as follows

Note that for users to be counted in the Registered Users for Application statistics which takes the number of users shared each of the Application, they should have to generate access tokens using Password Grant type.