OAuth Implicit Grant Flow

Developer Programs Support
1

Hello,
As of now we are using OAuth (Authorization code flow) in our system by creating the app following way

{
          "appName": "test-smartthings-webhook2",
          "appType": "API_ONLY",
           "classifications": [
                      "CONNECTED_SERVICE"
               ],
          "displayName": "test_name",
          "description": "web api testing",
          "singleInstance": false,
          "apiOnly": {
                   "targetUrl":"URI"
           },
          "oauth": {
                  "clientName": "oauth client",
                  "scope": [
                             "r:locations:*",
                             "r:devices:*",
                             "x:devices:*"
                  ],
                 "redirectUris": ["URI"]
          }
    }

Now we want to try OAuth (Implicit flow) in which it skips the authorization code step and directly returns the access token. Since we do not have any server to receive the auth code.

Does smartthing have or support OAuth Implicit Flow?

Also does smartthing support any other OAuth provider such as Google, Microsoft?

2

Hi, @Mohit_Gupta998
I will ask the engineering team about that and let you know.

Do you mean to implement your OAuth server using those services? In this case, we would like more details about how you would use those services to ask the engineering team if it’s possible.

3

No we do not want to implement our own OAuth server, As of now we use samsung account OAuth to authenticate user (we get details for samsung OAuth after creating the app such as client secret, client id etc), So can we use Google or other such authentication server too if smartthink provide support for those.

4

Please let us know
Thanks

5

A post was split to a new topic: Issues login in to the Community using Google

6

Hi, @Mohit_Gupta998
The engineering team mentioned the “implicit grant flow” is not supported since it’s considered less secure. Also, this way, users know exactly what they’re authorizing for your app.

Also, the authentication can be done only with a Samsung/SmartThings Account, no other authorization providers are supported.

7

Okay, Thanks for the prompt answer