A client is an application that requests permission to access a protected API. In the OAuth 2 authorization code flow, the authorization server obtains the user’s permission on the client’s behalf, then gives the client an access token it can use for authenticated API access. The protected API is called a resource server. section 8.1
The way a client obtains a token matters:
- Authorization code grant sends the user through the authorization server to give consent; this is the preferred flow here. section 8.1
- Implicit grant returns a token directly during the browser redirect, but is no longer generally recommended. section 8.1
- Client credentials grant uses the client’s own credentials. Its token supports non-user-focused operations, not actions on a user’s behalf. section 8.1
Mono<Ingredient> ingredientMono = webClient
.get()
.uri("http://localhost:8080/ingredients/{id}", ingredientId)
.retrieve()
.bodyToMono(Ingredient.class);
A client can also make an API request with Spring WebClient, as this ingredient lookup shows. This listing demonstrates the request, not how to attach an OAuth 2 access token. section 12.4.4
