The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server (the method of which is beyond the scope of this specification).
There's only one step in this process:
After this step, the client owns a Token that can be used to authorize any subsequent
request.
Request configuration for a ClientCredentials authentication
credentials (REQUIRED):
Credentials needed for Basic authentication.
url (REQUIRED):
The token endpoint to contact the authorization server.
scope (OPTIONAL):
The scope of the access request.
Describes a couple of client credentials used for Basic authentication
{ clientId = "<my-client-id>"
, secret = "<my-client-secret>"
}The response obtained as a result of an authentication (implicit or not)
token (REQUIRED):
The access token issued by the authorization server.
refreshToken (OPTIONAL):
The refresh token, which can be used to obtain new access tokens using the same authorization
grant as described in Section 6.
expiresIn (RECOMMENDED):
The lifetime in seconds of the access token. For example, the value "3600" denotes that the
access token will expire in one hour from the time the response was generated. If omitted, the
authorization server SHOULD provide the expiration time via other means or document the default
value.
scope (OPTIONAL, if identical to the scope requested; otherwise, REQUIRED):
The scope of the access token as described by Section 3.3.
Describes an OAuth error as a result of a request failure
error (REQUIRED):
A single ASCII error code.
errorDescription (OPTIONAL)
Human-readable ASCII text providing additional information, used to assist the client developer
in understanding the error that occurred. Values for the errorDescription parameter MUST NOT
include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
errorUri (OPTIONAL):
A URI identifying a human-readable web page with information about the error, used to provide
the client developer with additional information about the error. Values for the errorUri
parameter MUST conform to the URI-reference syntax and thus MUST NOT include characters outside
the set %x21 / %x23-5B / %x5D-7E.
Parts required to build a request. This record is given to Http.request
in order to create a new request and may be adjusted at will.
Json decoder for a positive response. You may provide a custom response decoder using other decoders from this module, or some of your own craft.
defaultAuthenticationSuccessDecoder : Decoder AuthenticationSuccess
defaultAuthenticationSuccessDecoder =
D.map4 AuthenticationSuccess
tokenDecoder
refreshTokenDecoder
expiresInDecoder
scopeDecoderJson decoder for an errored response.
case res of
Err (Http.BadStatus { body }) ->
case Json.decodeString OAuth.ClientCredentials.defaultAuthenticationErrorDecoder body of
Ok { error, errorDescription } ->
doSomething
_ ->
parserFailed
_ ->
someOtherErrorLike makeTokenRequest, but gives you the ability to specify custom grant
type and extra fields to be set on the query.
makeTokenRequest : (Result Http.Error AuthenticationSuccess -> msg) -> Authentication -> RequestParts msg
makeTokenRequest =
makeTokenRequestWith ClientCredentials defaultAuthenticationSuccessDecoder Dict.emptyJson decoder for the expiresIn field.
Json decoder for the scope field (space-separated).
Json decoder for the scope field (comma- or space-separated).
Json decoder for the access_token field.
Json decoder for the refresh_token field.
Json decoder for the error field.
Json decoder for the error_description field.
Json decoder for the error_uri field.
Builds a the request components required to get a token from client credentials