Skip to main content

OAuth2 resource owner password credentials grant

info

The resource owner password credentials grant is a legacy grant that is only supported in Ory Network for enterprise customers. Please contact sales@ory.sh for support.

The OAuth 2.0 Resource Owner Password Credentials Grant is an OAuth 2.0 grant where the application exchanges the user's username and password for an access token. This grant type is suitable for clients which are highly trusted by the user, such as his or her computer operating system or a highly privileged application. This grant type works as follows:

  1. The resource owner (i.e., the user) provides his or her username and password directly to the client.

  2. The client sends a POST request with following parameters in the request body using form encoding to the token endpoint:

    • grant_type: The value must be password.
    • client_id: The ID of the client that is making the request.
    • client_secret: The client secret that is used to authenticate the client. Only necessary if token_endpoint_auth_method is set to "client_secret_post" in the OAuth2 client.
    • username: The resource owner username.
    • password: The resource owner password.

  3. If the credentials are valid, the authorization server responds with an access token. This OAuth 2.0 grant does not support refresh tokens. The client has to ask the user for username and password whenever the access token expires.

To use the Resource Owner Password Credentials Grant, you need to include the "password" grant in the supported grant types. In the Ory Console, edit the grant types by creating or editing an OAuth client.

The credentials (username and password) are checked against Ory Identities. The user that is authenticated must already exist.