Resource Owner Password Credentials

This grant (RFC 6749 §4.3) lets a client exchange a user's username and password directly for an access token, skipping the redirect-based login screen entirely.

Not recommended

This flow requires the client application to handle raw user passwords, which defeats the core security benefit of OAuth 2.0 and is explicitly discouraged under OAuth 2.1. It also bypasses 3SO MFA challenges (TOTP, push, SMS) since there is no interactive login step. Only enable it for first-party legacy clients being migrated off basic auth, and prefer the Authorization Code flow with PKCE for everything else.

1. Token Request

The client collects the user’s username and password directly and submits them to the token endpoint.

POST /oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=password&
username=USER_EMAIL&
password=USER_PASSWORD&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
scope=read write

2. Token Response

On success, 3SO returns an access token and a refresh token, exactly as in the Authorization Code flow.

{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "GEbRxBN...edjnXbL",
  "scope": "read write"
}