Is it possible to generate an access token with only client id in password grant type?

[#1]

Now in order to generate an access token using password grant type I am sending the base64 encoded client credentials in Authorization header along with username and password in the body. Instead of sending the client credentials in the Authorization header, Is it possible to send the client id only in the query parameter and generate an access token in password grant type?

[anilsr]

@bibin_kurian ,

I am afraid you cannot, As per Apigee docs here, you need to send base64 encoded version of Authorization header which includes both client id & secret along with username/password.

[akoo · Accepted solution]

Hi @bibin_kurian,

To answer your question, yes, it's possible. You could use verifyApiKey policy to load client_secret in Apigee Edge. Then you could reconstruct the Basic Auth header using the client_id/secret to generate a token in a subsequent policy.

That said, I do not recommend this. The client_id is a public key; the process you describe does not offer much security on top of API key validation on its own. You're removing the client_secret requirement which is critical for OAuth v2 resource owner password credentials grant type (per spec). Furthermore, query parameters and URL are often logged by systems (routers, LBs, etc.)-- better to use the header.