The resource owner password credentials (ROPC) grant allows resource owners to provide trusted clients with their credentials which the clients can then use to obtain an access token. Clients can use the access token to access resources on the resource server. The intent of the ROPC grant is to provide access to resources in situations where there is an existing trust relationship between the resource owner and the client or when it is not possible to use other authorization grant types.

With the ROPC grant type, the client does not need resource owner approval nor does the client need a redirection endpoint. Instead the client calls the token endpoint on the authorization server directly, presenting the resource owner’s credentials for authentication. The token endpoint authenticates the credentials and issues an access token.

When using the ROPC grant type, the authorization server can issue a refresh token to the client application along with the access token. A refresh token enables clients to get a new access token without requesting additional approval from the resource owner. When the access token expires, the client application can use the pub.oauth:getToken service to pass the refresh token to the authorization server to request a new access token.

You use the ROPC grant type to authenticate and provide access to confidential clients. The ROPC grant type cannot be used with public clients.

The ROPC grant type is the least secure of all the grant type supported by Integration Server.

The following table describes each steep in the ROPC grant flow.