Implicit Grant

The Implicit grant is one of the OAuth 2.0 grant types supported in ReadyAPI. This grant is similar to the Authorization Code Grant, but instead of using the code as an intermediary, the access token is sent directly through a browser redirect.

To configure OAuth 2.0 authentication in ReadyAPI, see Enabling OAuth 2.0 Authentication or Enabling OAuth 2.0 Authentication with Azure Active Directory.

OAuth 2.0
ReadyAPI Get Access Token dialog overlaying the Auth Manager, with the OAuth 2 Flow set to "Implicit Grant". All fields are empty including Client Identification, Authorization URL, Redirect URL, Audience, Scope, and State. Additional Parameters and Use N
OAuth 2.0 Azure
ReadyAPI Get Access Token (Azure) dialog with the OAuth 2 Flow set to "Implicit Grant". All fields are empty including Client Identification, Resource, Authorization URL, Redirect URL, Audience, Scope, and State. Response Mode and Prompt are set to "Not d
Table 53. Implicit Grant - Get Access Token dialog options

Option

Description

OAuth 2 Flow

The OAuth 2.0 method to use.

Client Identification

An alphanumeric string that identifies the client.

Response Mode

(Azure only) Specifies how the authorization server sends the access token. Available options:

  • not defined - The authorization server will define which method to use.

  • form_post - The token will be sent as an HTML form by using the POST method.

  • query - The token will be added to the query as a parameter.

Resource

(Azure only) The App ID URI of the web service.

Important

Microsoft Identity Platform v2.0 does not support this parameter.

Prompt

(Azure only) Specifies whether the authentication server prompts the user to log in or to consent, even when already logged in. Possible values:

  • not defined - The server will not prompt a user to log in.

  • login - The server prompts you to log in again.

  • consent - The server asks the user to consent.

  • admin-consent - The server asks for the administrator's consent.

Login Hint

(Azure only) The string is displayed as a login hint in the sign-in form.

Domain Hint

(Azure only) Specifies the domain the user should use to sign in.

Authorization URL

The authorization server URL.

Access Token URL

The URL to use to get an access token.

Redirect URL

An authorized redirect URL registered for the application. After successful authentication, the web service redirects you to this URL. For details, see the OAuth 2.0 documentation.

Tip

For testing, use http://localhost:8080. Add this address to the list of authorized redirect URLs in your OAuth provider.

Scope

The full scope string defining the requested permissions.

Use Nonce

Generates a unique string for each request, allowing the server to verify that a request has never been made before. This helps prevent replay attacks.

State

The value included in the request is also added to the token response. Use this to generate a random string to prevent a cross-site request forgery attack.

Get Access Token

Retrieves the access token.

Automation

Opens the Automated Token Profile editor.



See Also

In this section:
© 2026
Publication date: