I have simple REST API, based on Asp.Net Core technology.

Now, I want to add OpenID for this API.

API would be used from mobile applications, single page applications and possibly other API services (not necessary).

It seems that I need Authorization flow, or Implicit, or even Hybrid, but as far as I understand, that when you use them, user needs explicitly set agreement with flows rights requirements. That's not what I want, flow must be invisible for user.

So, what flow should I choose?


Your API will not (normally) know or care what flow was used to obtain an access token, different client applications may use different flows.

Authorization flow and Hybrid flow are only suitable for confidential clients, i.e. ones that can keep a client secret. Single page apps and mobile applications cannot keep a client secret as the code is distributed to end users (e.g. in the .js files downloaded by your SPA). Therefore you should use Implicit flow in both cases.

Update: Implicit flow is dead, using code flow with PKCE for public clients is now recommended see:

| improve this answer | |
  • Ok, how about other API services whic can keep a client secret? – Yurii N. Jun 28 '17 at 18:10
  • @YuriyN. Can you be more specific about what this "other API" is? Client credentials might be appropriate (API authenticating as itself), or potentially Authorization code flow with a refresh token / offline access - this is the flow used for long-lived access on behalf of an end user, e.g. "Connect GitHub to Slack" etc... Alternatively the API could use the access token supplied by the caller, either of these options could be appropriate depending on what the API is doing. – Justin Jun 28 '17 at 19:16
  • About other API, I mean microservice architecture, where many web APIs connect with each other, what flow should be then? – Yurii N. Jun 28 '17 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.