处理OAuth2客户端凭据流

Question

I'm having trouble wrapping my head around implementing the client-credentials flow on the client side. Say the client requests a secure endpoint in an API without being authorized. The API will respond with 401 and that's that? As i understand it the client-credential flow should not require any user interaction, am i correct? Specifically, the client should not need to click, say, a button "Authorize client" before visiting any page that accesses protected resources?

Answer 1

You're right that there is no user interaction necessary. However, you must call the /token endpoint (with your credentials) to get back a token that you will later use in your API request's Authorization header.