I am very much confused about the way OAuth authorization and authentication works in Drupal 8/9. Let me put my points first, please correct me if I am wrong.

  • Authorization is when an entity proves a right to access.
  • Authentication is when an entity proves an identity.

I have done the following to implement a REST API which is intended to be consumed by mobile applications (Android and iOS).

  • Installed and/or enabled modules: Simple OAuth, REST UI, RESTful Web Services, Serialization.
  • Created a new role for specifying the scope of simple OAuth consumer, and set required permissions.
  • Created a consumer by adding RSA key pair, password and scope.
  • Succeeded in getting the response from /oauth/token by submitting a request body containing grant_type, client_id, client_secret, username and password.

The question is, why we need to send the username and password, for getting the access_token, since we are only trying to Authorize the API Request and NOT Authenticate the User?

Also, what should I do to Authorize the API request with OAuth but need to access contents without authentication? Should I create a dummy user and always send this user credentials to get access_token?

It would be very helpful if someone can explain the concept and how should one proceed.

Reference I followed: https://dev.acquia.com/blog/decoupled-drupal-authentication-oauth-20

  • Why not add 8 tag. Since this question also applies to Drupal 8. Also additionally, it will reach those who watch tags for Drupal 8.
    – Harish ST
    Commented Jun 26, 2020 at 7:45

1 Answer 1


Actually, I got the solution. It was my mistake, that I was trying to use OAuth2 3-legged authorization, but I am actually need OAuth 2-legged authorization.

More Details on oAuth Flow and Grant Types: oAuth Grant Types

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.