Which OAuth 2.0 grant works best for me?
A grant is a method to acquire an access token. To decide the implementation of a grant, you need to consider the type of client end-user will be using and the end-user experience.
OpenID Connect supports the following authentication flows:
Which flow to use?
│
├── I want to be on the Apaleo Store ─────────────▶ Authorization code grant flow
│
└── I am building an app for a particular hotel ──▶ Client credentials grant flow
| Use Case | Trustworthiness | Suggested OAuth 2.0 Authorization Grant_type |
|---|---|---|
| Publicly available apps (Apaleo store apps) | • Most secure grant type. • If the client is a web app that has a server-side component, then you should implement the authorization code grant. • If you can use server-side scripting, then use this grant. |
Authorization code grant, registered as a fine-grained client (recommended) |
| Private apps (custom project for one hotel) | • Highly trusted applications, written by internal developers or developers with a trusted business relationship with the user. • All parties trust each other and no external resources are involved. • Usually used for machine-to-machine authorization. • Applications that need to access resources on their own behalf. |
Client credentials grant |
Apaleo’s recommendation for store apps. Apps listed on the Apaleo Store should use the authorization code grant and be registered as a fine-grained client. A fine-grained client is granted only the permissions it needs, and hotels choose which of their properties to share when they connect it. Only apps registered as Apaleo Connect clients (authorization code grant) can have a store listing. See List your app.
Choose how your app is granted access
Besides the grant, you also choose a client access type when you register your app. It can’t be changed after the app is created.
- Fine-grained client (recommended): your app is granted only the exact permissions it needs, per API, on the properties a hotel selects.
- Scope client: your app is granted broad API scopes, which are bundled into the OAuth token.
This applies to both store apps (authorization code grant) and custom apps (client credentials grant). Both types use the same grants and flows. For the differences, see Scopes and permissions.
Implementing OAuth in your applications
Before you start, register your app and choose its client access type: Register an OAuth connect client (Apaleo store) app or Register an OAuth simple client (custom) app.
The following topics describe how to generate OAuth access tokens using each of the two grant flows: