Does grant_type=authorization_code always require a manual intervention for providing username/password

[jmelberg]

Hey @mksmanjit,

I’m going to piggy-back on some of the responses here - as I think the correct approach has already been discussed. But let me try and reiterate a few things.

Since you’re looking for no “manual intervention”, you have two possible solutions:

Use the resource owner password flow
Based on how much control you have over your app - this might be the best option for you. Here, you’ll need to embed your clientId and clientSecret into your application to make calls to the /token endpoint as you mentioned before. This flow isn’t recommeneded for Single-Page Apps, or anything considered a public client (see client types in the OAuth 2.0 spec).

Use the sessionToken flow
As mentioned earlier, you can leverage the Okta sessionToken to bootstrap your login flow. Essentially:

1. Submit user credentials to /api/v1/authn to receive a sessionToken
2. Perform the /authorize call using the sessionToken and setting the reponse_type=code
3. Once the code is returned, exchange it for an accessToken via the /token endpoint

Both flows only require the user credentials - and do not require using a browser and/or any “manual intervention”.

Hope this helps!