Search code examples
authenticationspring-securityoauth-2.0authorization

How do we specify our target Reaource Server in Client Credential grant's access token request?


How do we specify our target Reaource Server in Client Credential's access token request?

In the access token request, there is no uri about the target; about the resource server. We just specify Authorization Sever's url.

So the access token that we'll receive, is not specific to the Resource Service. right?

How the received token is related to the resource url?


Solution

  • You don't have to specify resource server in access token request. You have to specify scopes instead which you configured while registering your app by generating client id(app id) and client secret(app secret).

    When you request for token, Authorization sever will validate that are you allowed get access to provided scopes or not. Hence app allowed to access only resources which you have configured.

    Have a look at this post for further understanding:

    https://www.oauth.com/oauth2-servers/the-resource-server/