5 ms·

PKCE, OAuth 2.0 for Native Apps and the Device Code flow are a thing. In practice all of these clients work so well with OAuth 2.0, that the implicit and resour

• ForHackernews 3mo ago
  ... so, then, there is a need for something other than a shared opaque random string API key? I feel like I'm being argued in a circle by a series of strawmen.
  • doc_ick 3mo ago
    Random strings aren’t truly random, can be predicted, and don’t carry information that can be used elsewhere
  • unscaled 3mo ago
    For what? For just authenticating a client application to a server without getting access to any user data? By all means. You usually don't need the client credentials in OAuth 2.0 if you don't want to use it. But if you want access to user information, you can't just give access to an app that has a shared secret key to a all user data for every single users in the planet. You need to authenticate the user somehow, and sharing the user's password directly with the app is not a good idea for many reasons. Even if you trust the app to be "written without any bugs", the moment you allow the password grant in OAuth, your service cannot use CAPTCHA, MFA or Passkeys efficiently. The password grant does not allow any of these, so this app that you've let through becomes the weakest link for all cybercrime groups that want to attack your service.