Verify if proxy supports token with grant type

[openapidev]

Hello,

How may I restrict access for a proxy/product via access token which has a particular grant type?

For example, if the token was generated using a grant type client credentials, we don't want to allow this token in proxies/products which are used for authorization grant type flow.

The only solution we found was to verify the access token side proxy and then check the grant type flow variable and raise a fault if the tokens grant type is not valid.

Is there a way to link scopes to grant type? It will be also a solution.

Thanks

[dchiesa1 · Accepted solution]

The way you are doing it makes the most sense to me.

If you want, an alternative is what you suggested: populate the scope at the time of generation via the authorization code grant, with something specific that would indicate the token is valid for accessing user-specific information. This is probably not grant_type, but ... something else that would be more meaningful, like "user_information_access" or something like that.

If you're a more mature API organization, your team or organization has a list of scopes that are used in various APIs, and a pattern or framework for adding new ones into the list. In that case, you can just add this particular scope to that set of "known scopes", or use an existing scope from that list if it fits your purposes. (This isn't a runtime thing, more of a development-time and governance issue)

[openapidev]

Thank you, Dino,

I think solution proposed by you will work fine in our case.