I have configured an API and my client can only to pass client_id to get OAuth token back as a response. He can't pass client secret and no redirect_url. I tried with Implicit type and I see the below redirect url. can anyone help?
{
"error": "invalid_request",
"error_description": "Redirect URI specified in the request is not configured in the client subscription"
}
Is there any alternative way?
Note that: Implicit grant flow requires redirect URL as a parameter. Refer this MsDoc
If you don't want to pass client secret and redirect URL in the request, then you can make use of ROPC flow or Device code flow
Hence, to generate access token by passing ClientID only, enable Allow public client flows
as YES
And pass the below request:
https://login.microsoftonline.com/TenantID/oauth2/v2.0/token
client_id=ClientID
grant_type=password
username=UserName
password=Password
scope=user.read openid offline_access profile
Otherwise, you can also make use of Device authorization request like below:
https://login.microsoftonline.com/TenantID/oauth2/v2.0/devicecode
client_id=ClientID
scope=user.read
This will generate a verification_uri
and a user_code
:
Now click on the verification_uri
in the browser and enter the code:
That is paste this URL in broswerhttps://microsoft.com/devicelogin
and enter code
And sign-in to authenticate:
Generate the access token by using below parameters:
https://login.microsoftonline.com/TenantID/oauth2/v2.0/token
grant_type:urn:ietf:params:oauth:grant-type:device_code
client_id:ClientID
device_code:DeviceCodeFromAboveRequest