I have secured a REST API using OAuth 2.0 security, and I am not sure on how to configure security access using roles or scopes.

There will be three types of clients:

  • Public mobile app client used by end-users that can access their profile, data, etc. (using password grant type). By "public" I mean that the app is intended from any user and available to any user from Google Store, etc.)
  • Non-public administration client used only from me for administrative purposes that can access administrative services not allowed to be used by normal users (using client_credentials grant type).
  • Non-public third-party client (using client_credentials grant type) that will use some services created specifically for them.

Should I just create three different roles, User, Admin and ThirdPartyX and secure services with 'oauth2.clientHasRole' rules? Or should I create different scopes and do not care about roles? Is there a general rule of thumb on where would I use roles or scopes in general?


There is usually no golden right way for the problem. However, there are a few guidelines:

Use the scope request parameter as indicated in the IETF standard.

Use the claim in the JWT payload with an HMAC256 signature to verify the claims are issued by the server.

Map your roles permissions data to an RBAC database schema (but we usually use MongoDB with NoSQL).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.