# RFC6749: The OAuth 2.0 Authorization Framework

This section contains the generic implementation of RFC6749. You should read Introduce OAuth 2.0 at first. Here are some tips:

1. Have a better understanding of OAuth 2.0

2. How to use OAuth 2 Session for Requests

3. How to implement Flask OAuth Client

4. How to implement Flask OAuth 2.0 Server

5. How to implement Django OAuth Client

6. How to implement Django OAuth 2.0 Server

## API References

Here are the API references for developers. For framework level interfaces, check:

### Servers

class authlib.oauth2.rfc6749.AuthorizationServer(scopes_supported=None)

  Authorization server that handles Authorization Endpoint and Token Endpoint.

  Parameters:

    scopes_supported – A list of supported scopes by this authorization server.

  authenticate_client(request, methods, endpoint='token')

    Authenticate client via HTTP request information with the given methods, such as `client_secret_basic`, `client_secret_post`.

  create_endpoint_response(name, request=None)

    Validate endpoint request and create endpoint response.

    Parameters:

      - name – Endpoint name

      - request – HTTP request instance.

    Returns:

      Response

  create_json_request(request) → JsonRequest

    This method MUST be implemented in framework integrations. It is used to create an HttpRequest instance.

    Parameters:

      request – the “request” instance in framework

    Returns:

      HttpRequest instance

  create_oauth2_request(request) → OAuth2Request

    This method MUST be implemented in framework integrations. It is used to create an OAuth2Request instance.

    Parameters:

      request – the “request” instance in framework

    Returns:

      OAuth2Request instance

  create_token_response(request=None)

    Validate token request and create token response.

    Parameters:

      request – HTTP request instance

  generate_token(grant_type, client, user=None, scope=None, expires_in=None, include_refresh_token=True)

    Generate the token dict.

    Parameters:

      - grant_type – current requested grant_type.

      - client – the client that making the request.

      - user – current authorized user.

      - expires_in – if provided, use this value as expires_in.

      - scope – current requested scope.

      - include_refresh_token – should refresh_token be included.

    Returns:

      Token dict

  get_consent_grant(request=None, end_user=None)

    Validate current HTTP request for authorization page. This page is designed for resource owner to grant or deny the authorization.

  get_error_uri(request, error)

    Return a URI for the given error, framework may implement this method.

  get_token_grant(request)

    Find the token grant for current request.

    Parameters:

      request – OAuth2Request instance.

    Returns:

      grant instance

  handle_response(status, body, headers)

    Return HTTP response. Framework MUST implement this function.

  query_client(client_id)

    Query OAuth client by client_id. The client model class MUST implement the methods described by `ClientMixin`.

  register_client_auth_method(method, func)

    Add more client auth method. The default methods are:

    - none: The client is a public client and does not have a client secret

    - client_secret_post: The client uses the HTTP POST parameters

    - client_secret_basic: The client uses HTTP Basic

    Parameters:

      - method – Name of the Auth method

      - func – Function to authenticate the client

    The auth method accept two parameters: `query_client` and `request`, an example for this method:

        def authenticate_client_via_custom(query_client, request):
            client_id = request.headers["X-Client-Id"]
            client = query_client(client_id)
            do_some_validation(client)
            return client

        authorization_server.register_client_auth_method(
            "custom", authenticate_client_via_custom
        )

  register_endpoint(endpoint)

    Add extra endpoint to authorization server. e.g. RevocationEndpoint:

        authorization_server.register_endpoint(RevocationEndpoint)

    Parameters:

      endpoint_cls – A endpoint class or instance.

  register_grant(grant_cls, extensions=None)

    Register a grant class into the endpoint registry. Developers can implement the grants in `authlib.oauth2.rfc6749.grants` and register with this method:

        class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
            def authenticate_user(self, credential):
                # ...

        authorization_server.register_grant(AuthorizationCodeGrant)

    Parameters:

      - grant_cls – a grant class.

      - extensions – extensions for the grant class.

  register_token_generator(grant_type, func)

    Register a function as token generator for the given `grant_type`. Developers MUST register a default token generator with a special `grant_type=default`:

        def generate_bearer_token(
            grant_type,
            client,
            user=None,
            scope=None,
            expires_in=None,
            include_refresh_token=True,
        ):
            token = {"token_type": "Bearer", "access_token": ...}
            if include_refresh_token:
                token["refresh_token"] = ...
            ...
            return token

        authorization_server.register_token_generator(
            "default", generate_bearer_token
        )

    If you register a generator for a certain grant type, that generator will only works for the given grant type:

        authorization_server.register_token_generator(
            "client_credentials",
            generate_bearer_token,
        )

    Parameters:

      - grant_type – string name of the grant type

      - func – a function to generate token

  save_token(token, request)

    Define function to save the generated token into database.

  send_signal(name, *args, **kwargs)

    Framework integration can re-implement this method to support signal system.

  validate_requested_scope(scope)

    Validate if requested scope is supported by Authorization Server. Developers CAN re-write this method to meet your needs.

class authlib.oauth2.rfc6749.ResourceProtector
  get_token_validator(token_type)

    Get token validator from registry for the given token type.

  parse_request_authorization(request)

    Parse the token and token validator from request Authorization header. Here is an example of Authorization header:

        Authorization: Bearer a-token-string

    This method will parse this header, if it can find the validator for `Bearer`, it will return the validator and `a-token-string`.

    Returns:

      validator, token_string

    Raise:

      MissingAuthorizationError

    Raise:

      UnsupportedTokenTypeError

  register_token_validator(validator: TokenValidator)

    Register a token validator for a given Authorization type. Authlib has a built-in BearerTokenValidator per rfc6750.

  validate_request(scopes, request, **kwargs)

    Validate the request and return a token.

### Client Model

class authlib.oauth2.rfc6749.ClientMixin

  Implementation of OAuth 2 Client described in Section 2 with some methods to help validation. A client has at least these information:

  - client_id: A string represents client identifier.

  - client_secret: A string represents client password.

  - token_endpoint_auth_method: A way to authenticate client at token

      endpoint.

  check_client_secret(client_secret)

    Check client_secret matching with the client. For instance, in the client table, the column is called `client_secret`:

        import secrets

        def check_client_secret(self, client_secret):
            return secrets.compare_digest(self.client_secret, client_secret)

    Parameters:

      client_secret – A string of client secret

    Returns:

      bool

  check_endpoint_auth_method(method, endpoint)

    Check if client support the given method for the given endpoint. There is a `token_endpoint_auth_method` defined via RFC7591. Developers MAY re-implement this method with:

        def check_endpoint_auth_method(self, method, endpoint):
            if endpoint == "token":
                # if client table has ``token_endpoint_auth_method``
                return self.token_endpoint_auth_method == method
            return True

    Method values defined by this specification are:

    - “none”: The client is a public client as defined in OAuth 2.0,

        and does not have a client secret.

    - “client_secret_post”: The client uses the HTTP POST parameters

        as defined in OAuth 2.0

    - “client_secret_basic”: The client uses HTTP Basic as defined in

        OAuth 2.0

  check_grant_type(grant_type)

    Validate if the client can handle the given grant_type. There are four grant types defined by RFC6749:

    - authorization_code

    - implicit

    - client_credentials

    - password

    For instance, there is a `allowed_grant_types` column in your client:

        def check_grant_type(self, grant_type):
            return grant_type in self.grant_types

    Parameters:

      grant_type – the requested grant_type string.

    Returns:

      bool

  check_redirect_uri(redirect_uri)

    Validate redirect_uri parameter in Authorization Endpoints. For instance, in the client table, there is an `allowed_redirect_uris` column:

        def check_redirect_uri(self, redirect_uri):
            return redirect_uri in self.allowed_redirect_uris

    Parameters:

      redirect_uri – A URL string for redirecting.

    Returns:

      bool

  check_response_type(response_type)

    Validate if the client can handle the given response_type. There are two response types defined by RFC6749: code and token. For instance, there is a `allowed_response_types` column in your client:

        def check_response_type(self, response_type):
            return response_type in self.response_types

    Parameters:

      response_type – the requested response_type string.

    Returns:

      bool

  get_allowed_scope(scope)

    A method to return a list of requested scopes which are supported by this client. For instance, there is a `scope` column:

        def get_allowed_scope(self, scope):
            if not scope:
                return ""
            allowed = set(scope_to_list(self.scope))
            return list_to_scope([s for s in scope.split() if s in allowed])

    Parameters:

      scope – the requested scope.

    Returns:

      string of scope

  get_client_id()

    A method to return client_id of the client. For instance, the value in database is saved in a column called `client_id`:

        def get_client_id(self):
            return self.client_id

    Returns:

      string

  get_default_redirect_uri()

    A method to get client default redirect_uri. For instance, the database table for client has a column called `default_redirect_uri`:

        def get_default_redirect_uri(self):
            return self.default_redirect_uri

    Returns:

      A URL string

### Token Model

class authlib.oauth2.rfc6749.AuthorizationCodeMixin
  get_redirect_uri()

    A method to get authorization code’s `redirect_uri`. For instance, the database table for authorization code has a column called `redirect_uri`:

        def get_redirect_uri(self):
            return self.redirect_uri

    Returns:

      A URL string

  get_scope()

    A method to get scope of the authorization code. For instance, the column is called `scope`:

        def get_scope(self):
            return self.scope

    Returns:

      scope string

class authlib.oauth2.rfc6749.TokenMixin
  check_client(client)

    A method to check if this token is issued to the given client. For instance, `client_id` is saved on token table:

        def check_client(self, client):
            return self.client_id == client.client_id

    Returns:

      bool

  get_client() → ClientMixin

    A method to get the client object associated with this token:

        def get_client(self):
            return Client.get(self.client_id)

  get_expires_in()

    A method to get the `expires_in` value of the token. e.g. the column is called `expires_in`:

        def get_expires_in(self):
            return self.expires_in

    Returns:

      timestamp int

  get_scope()

    A method to get scope of the authorization code. For instance, the column is called `scope`:

        def get_scope(self):
            return self.scope

    Returns:

      scope string

  get_user()

    A method to get the user object associated with this token:

        def get_user(self):
            return User.get(self.user_id)

  is_expired()

    A method to define if this token is expired. For instance, there is a column `expired_at` in the table:

        def is_expired(self):
            return self.expired_at < now

    Returns:

      boolean

  is_revoked()

    A method to define if this token is revoked. For instance, there is a boolean column `revoked` in the table:

        def is_revoked(self):
            return self.revoked

    Returns:

      boolean

### Errors

class authlib.oauth2.rfc6749.OAuth2Error(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)
  get_body()

    Get a list of body.

class authlib.oauth2.rfc6749.InsecureTransportError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)
  classmethod check(uri)

    Check and raise InsecureTransportError with the given URI.

  description = 'OAuth 2 MUST utilize https.'

    long-string to describe this error

  error = 'insecure_transport'

    short-string error code

class authlib.oauth2.rfc6749.InvalidRequestError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)

  The request is missing a required parameter, includes an unsupported parameter value (other than grant type), repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed.

  https://tools.ietf.org/html/rfc6749#section-5.2

class authlib.oauth2.rfc6749.InvalidClientError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)

  Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the “Authorization” request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code and include the “WWW-Authenticate” response header field matching the authentication scheme used by the client.

  https://tools.ietf.org/html/rfc6749#section-5.2

class authlib.oauth2.rfc6749.InvalidGrantError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)

  The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.

  https://tools.ietf.org/html/rfc6749#section-5.2

class authlib.oauth2.rfc6749.UnauthorizedClientError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)

  The authenticated client is not authorized to use this authorization grant type.

  https://tools.ietf.org/html/rfc6749#section-5.2

class authlib.oauth2.rfc6749.UnsupportedGrantTypeError(grant_type)

  The authorization grant type is not supported by the authorization server.

  https://tools.ietf.org/html/rfc6749#section-5.2

class authlib.oauth2.rfc6749.InvalidScopeError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)

  The requested scope is invalid, unknown, malformed, or exceeds the scope granted by the resource owner.

  https://tools.ietf.org/html/rfc6749#section-5.2

class authlib.oauth2.rfc6749.AccessDeniedError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)

  The resource owner or authorization server denied the request.

  Used in authorization endpoint for “code” and “implicit”. Defined in Section 4.1.2.1.

### Grant Types

class authlib.oauth2.rfc6749.grants.AuthorizationCodeGrant(request: OAuth2Request, server)

  The authorization code grant type is used to obtain both access tokens and refresh tokens and is optimized for confidential clients. Since this is a redirection-based flow, the client must be capable of interacting with the resource owner’s user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server:

      +----------+
      | Resource |
      |   Owner  |
      |          |
      +----------+
           ^
           |
          (B)
      +----|-----+          Client Identifier      +---------------+
      |         -+----(A)-- & Redirection URI ---->|               |
      |  User-   |                                 | Authorization |
      |  Agent  -+----(B)-- User authenticates --->|     Server    |
      |          |                                 |               |
      |         -+----(C)-- Authorization Code ---<|               |
      +-|----|---+                                 +---------------+
        |    |                                         ^      v
       (A)  (C)                                        |      |
        |    |                                         |      |
        ^    v                                         |      |
      +---------+                                      |      |
      |         |>---(D)-- Authorization Code ---------'      |
      |  Client |          & Redirection URI                  |
      |         |                                             |
      |         |<---(E)----- Access Token -------------------'
      +---------+       (w/ Optional Refresh Token)

  TOKEN_ENDPOINT_AUTH_METHODS = ['client_secret_basic', 'client_secret_post']

    Allowed client auth methods for token endpoint

  AUTHORIZATION_CODE_LENGTH = 48

    Generated “code” length

  GRANT_TYPE = 'authorization_code'

    Designed for which “grant_type”

  validate_authorization_request()

    The client constructs the request URI by adding the following parameters to the query component of the authorization endpoint URI using the “application/x-www-form-urlencoded” format. Per Section 4.1.1.

    response_type

      REQUIRED. Value MUST be set to “code”.

    client_id

      REQUIRED. The client identifier as described in Section 2.2.

    redirect_uri

      OPTIONAL. As described in Section 3.1.2.

    scope

      OPTIONAL. The scope of the access request as described by Section 3.3.

    state

      RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHOULD be used for preventing cross-site request forgery as described in Section 10.12.

    The client directs the resource owner to the constructed URI using an HTTP redirection response, or by other means available to it via the user-agent.

    For example, the client directs the user-agent to make the following HTTP request using TLS (with extra line breaks for display purposes only):

        GET /authorize?response_type=code&client_id=s6BhdRkqt3&state=xyz
        &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb HTTP/1.1
        Host: server.example.com

    The authorization server validates the request to ensure that all required parameters are present and valid. If the request is valid, the authorization server authenticates the resource owner and obtains an authorization decision (by asking the resource owner or by establishing approval via other means).

  create_authorization_response(redirect_uri: str, grant_user)

    If the resource owner grants the access request, the authorization server issues an authorization code and delivers it to the client by adding the following parameters to the query component of the redirection URI using the “application/x-www-form-urlencoded” format. Per Section 4.1.2.

    code

      REQUIRED. The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI.

    state

      REQUIRED if the “state” parameter was present in the client authorization request. The exact value received from the client.

    For example, the authorization server redirects the user-agent by sending the following HTTP response.

        HTTP/1.1 302 Found
        Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA
               &state=xyz

    Parameters:

      - redirect_uri – Redirect to the given URI for the authorization

      - grant_user – if resource owner granted the request, pass this resource owner, otherwise pass None.

    Returns:

      (status_code, body, headers)

  generate_authorization_code()

    “The method to generate “code” value for authorization code data. Developers may rewrite this method, or customize the code length with:

        class MyAuthorizationCodeGrant(AuthorizationCodeGrant):
            AUTHORIZATION_CODE_LENGTH = 32  # default is 48

  save_authorization_code(code, request)

    Save authorization_code for later use. Developers MUST implement it in subclass. Here is an example:

        def save_authorization_code(self, code, request):
            client = request.client
            item = AuthorizationCode(
                code=code,
                client_id=client.client_id,
                redirect_uri=request.payload.redirect_uri,
                scope=request.payload.scope,
                user_id=request.user.id,
            )
            item.save()

  query_authorization_code(code, client)

    Get authorization_code from previously savings. Developers MUST implement it in subclass:

        def query_authorization_code(self, code, client):
            return Authorization.get(code=code, client_id=client.client_id)

    Parameters:

      - code – a string represent the code.

      - client – client related to this code.

    Returns:

      authorization_code object

  delete_authorization_code(authorization_code)

    Delete authorization code from database or cache. Developers MUST implement it in subclass, e.g.:

        def delete_authorization_code(self, authorization_code):
            authorization_code.delete()

    Parameters:

      authorization_code – the instance of authorization_code

  authenticate_user(authorization_code)

    Authenticate the user related to this authorization_code. Developers MUST implement this method in subclass, e.g.:

        def authenticate_user(self, authorization_code):
            return User.get(authorization_code.user_id)

    Parameters:

      authorization_code – AuthorizationCode object

    Returns:

      user

class authlib.oauth2.rfc6749.grants.ImplicitGrant(request: OAuth2Request, server)

  The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript.

  Since this is a redirection-based flow, the client must be capable of interacting with the resource owner’s user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server.

  Unlike the authorization code grant type, in which the client makes separate requests for authorization and for an access token, the client receives the access token as the result of the authorization request.

  The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device:

      +----------+
      | Resource |
      |  Owner   |
      |          |
      +----------+
           ^
           |
          (B)
      +----|-----+          Client Identifier     +---------------+
      |         -+----(A)-- & Redirection URI --->|               |
      |  User-   |                                | Authorization |
      |  Agent  -|----(B)-- User authenticates -->|     Server    |
      |          |                                |               |
      |          |<---(C)--- Redirection URI ----<|               |
      |          |          with Access Token     +---------------+
      |          |            in Fragment
      |          |                                +---------------+
      |          |----(D)--- Redirection URI ---->|   Web-Hosted  |
      |          |          without Fragment      |     Client    |
      |          |                                |    Resource   |
      |     (F)  |<---(E)------- Script ---------<|               |
      |          |                                +---------------+
      +-|--------+
        |    |
       (A)  (G) Access Token
        |    |
        ^    v
      +---------+
      |         |
      |  Client |
      |         |
      +---------+

  AUTHORIZATION_ENDPOINT = True

    authorization_code grant type has authorization endpoint

  TOKEN_ENDPOINT_AUTH_METHODS = ['none']

    Allowed client auth methods for token endpoint

  GRANT_TYPE = 'implicit'

    Designed for which “grant_type”

class authlib.oauth2.rfc6749.grants.ResourceOwnerPasswordCredentialsGrant(request: OAuth2Request, server)

  The resource owner password credentials grant type is suitable in cases where the resource owner has a trust relationship with the client, such as the device operating system or a highly privileged.

  application. The authorization server should take special care when enabling this grant type and only allow it when other flows are not viable.

  This grant type is suitable for clients capable of obtaining the resource owner’s credentials (username and password, typically using an interactive form). It is also used to migrate existing clients using direct authentication schemes such as HTTP Basic or Digest authentication to OAuth by converting the stored credentials to an access token:

      +----------+
      | Resource |
      |  Owner   |
      |          |
      +----------+
          v
          |    Resource Owner
         (A) Password Credentials
          |
          v
      +---------+                                  +---------------+
      |         |>--(B)---- Resource Owner ------->|               |
      |         |         Password Credentials     | Authorization |
      | Client  |                                  |     Server    |
      |         |<--(C)---- Access Token ---------<|               |
      |         |    (w/ Optional Refresh Token)   |               |
      +---------+                                  +---------------+

  GRANT_TYPE = 'password'

    Designed for which “grant_type”

  validate_token_request()

    The client makes a request to the token endpoint by adding the following parameters using the “application/x-www-form-urlencoded” format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body:

    grant_type

      REQUIRED. Value MUST be set to “password”.

    username

      REQUIRED. The resource owner username.

    password

      REQUIRED. The resource owner password.

    scope

      OPTIONAL. The scope of the access request as described by Section 3.3.

    If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in Section 3.2.1.

    For example, the client makes the following HTTP request using transport-layer security (with extra line breaks for display purposes only):

        POST /token HTTP/1.1
        Host: server.example.com
        Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
        Content-Type: application/x-www-form-urlencoded

        grant_type=password&username=johndoe&password=A3ddj3w

  authenticate_user(username, password)

    Validate the resource owner password credentials using its existing password validation algorithm:

        def authenticate_user(self, username, password):
            user = get_user_by_username(username)
            if user.check_password(password):
                return user

class authlib.oauth2.rfc6749.grants.ClientCredentialsGrant(request: OAuth2Request, server)

  The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server.

  The client credentials grant type MUST only be used by confidential clients:

      +---------+                                  +---------------+
      |         |                                  |               |
      |         |>--(A)- Client Authentication --->| Authorization |
      | Client  |                                  |     Server    |
      |         |<--(B)---- Access Token ---------<|               |
      |         |                                  |               |
      +---------+                                  +---------------+

  https://tools.ietf.org/html/rfc6749#section-4.4

  GRANT_TYPE = 'client_credentials'

    Designed for which “grant_type”

  validate_token_request()

    The client makes a request to the token endpoint by adding the following parameters using the “application/x-www-form-urlencoded” format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body:

    grant_type

      REQUIRED. Value MUST be set to “client_credentials”.

    scope

      OPTIONAL. The scope of the access request as described by Section 3.3.

    The client MUST authenticate with the authorization server as described in Section 3.2.1.

    For example, the client makes the following HTTP request using transport-layer security (with extra line breaks for display purposes only):

        POST /token HTTP/1.1
        Host: server.example.com
        Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
        Content-Type: application/x-www-form-urlencoded

        grant_type=client_credentials

    The authorization server MUST authenticate the client.

class authlib.oauth2.rfc6749.grants.RefreshTokenGrant(request: OAuth2Request, server)

  A special grant endpoint for refresh_token grant_type. Refreshing an Access Token per Section 6.

  GRANT_TYPE = 'refresh_token'

    Designed for which “grant_type”

  INCLUDE_NEW_REFRESH_TOKEN = False

    The authorization server MAY issue a new refresh token

  validate_token_request()

    If the authorization server issued a refresh token to the client, the client makes a refresh request to the token endpoint by adding the following parameters using the “application/x-www-form-urlencoded” format per Appendix B with a character encoding of UTF-8 in the HTTP request entity-body, per Section 6:

    grant_type

      REQUIRED. Value MUST be set to “refresh_token”.

    refresh_token

      REQUIRED. The refresh token issued to the client.

    scope

      OPTIONAL. The scope of the access request as described by Section 3.3. The requested scope MUST NOT include any scope not originally granted by the resource owner, and if omitted is treated as equal to the scope originally granted by the resource owner.

    For example, the client makes the following HTTP request using transport-layer security (with extra line breaks for display purposes only):

        POST /token HTTP/1.1
        Host: server.example.com
        Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
        Content-Type: application/x-www-form-urlencoded

        grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA

  authenticate_refresh_token(refresh_token)

    Get token information with refresh_token string. Developers MUST implement this method in subclass:

        def authenticate_refresh_token(self, refresh_token):
            token = Token.get(refresh_token=refresh_token)
            if token and not token.refresh_token_revoked:
                return token

    Parameters:

      refresh_token – The refresh token issued to the client

    Returns:

      token

  authenticate_user(refresh_token)

    Authenticate the user related to this credential. Developers MUST implement this method in subclass:

        def authenticate_user(self, credential):
            return User.get(credential.user_id)

    Parameters:

      refresh_token – Token object

    Returns:

      user

  revoke_old_credential(refresh_token)

    The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. Developers MUST implement this method in subclass:

        def revoke_old_credential(self, refresh_token):
            credential.revoked = True
            credential.save()

    Parameters:

      refresh_token – Token object