Mgiyuk

Which oauth or openid-connect I need to choose in order to build a public sdk? I am going to build an SDK for developers to access my backend restful resources. For example, I defined below restful apis: get GET /changes/changeId list GET /changes getStartPageToken GET /changes/startPageToken I need to secure my apis and I come across openid-connect, auth1 and auth2 but I am not sure which one I need to use. As far as I know, auth2 is more used to third-party authentication like login as google , facebook account etc. Is this right? google facebook In some other public APIs design, a developer need to register a developer account and get an app key and secret. They can use the key and secret to use their APIs. Which type of this authentication is it? Which one among them is more appropriate for my use case? Did you find an answer for this ? – Kavindu Dodanduwa 1 hour ago ...

Azure OpenID connect app prompts for offline access I've registered an application/client on https://apps.dev.microsoft.com/ requesting only the openid scope, when I try to access that application via a link like https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=id_token+token&client_id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX&response_mode=form_post&redirect_uri=http://localhost:8765/test/response&scope=openid&state=123abc One of the prompts on the authorization screen is "Access your data anytime" according to https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-scopes#offlineaccess that prompt should only be shown when requesting offline_access. What can I do to have it not prompt for "Access your data anytime"? It seems you are using implicit flow. And that must not get a refresh token so "access your data anytime" should not present in consent. Ca...