The ROPC grant flow

The ROPC flow moves the resource owner’s credential management into the client application. The resource owner is prompted directly by the client application, which usually has a form where the user can insert their credentials. For this reason, ROPC is not a recommended flow because it trusts that the client application will not misuse a user’s credentials.

The flow is described in the following diagram:

Figure 4.6 – ROPC grant flow

The diagram is explained in detail as follows:

1. The resource owner directly inserts their credentials within the client application.
2. The client application requests an access token directly to the /token endpoint of the authorization (AuthZ) server by sending the credentials the resource owner provided in the previous step. This is what a request looks like:

   POST /token?

   grant_type=PASSWORD

   &client_id=s6BhdRkqt3

   &scope=resource_server_id%20offline_access

   &username=userid1...