Which two grant types are supported for native and third-party OAuth providers?

IBM API Connect, when configured as a native or third-party OAuth provider, supports several standard OAuth 2.0 grant types. Among the options provided, "Application (client-credentials)" and "Implicit" are two of the supported grant types. The Application grant type, also known as client credentials, is used for machine-to-machine authentication where an application accesses its own resources. The Implicit grant type is a simplified flow intended for use by public clients, such as single-page web applications, where the access token is returned directly to the client.

1. IBM Documentation for API Connect v10.x: In the section for configuring a native OAuth provider

the documentation lists the supported grant types.

Source: IBM Documentation

API Connect Version 10.0.x

"Configuring a native OAuth provider".

Reference: In the "OAuth provider settings" table

under the "Supported grant types" row

the documentation explicitly lists application (Client Credentials) and implicit as supported types.

2. The OAuth 2.0 Authorization Framework (RFC 6749): This foundational document defines the standard grant types.

Source: IETF RFC 6749

"The OAuth 2.0 Authorization Framework".

Reference: Section 4.4

"Client Credentials Grant

" defines the flow corresponding to the "Application" grant type. Section 4.2

"Implicit Grant

" defines the "Implicit" flow. The terms "Explicit

" "Inhibit

" and "Exhibit" are not defined as grant types in this specification.