Grant

A grant represents a resource owner’s authorization for a client application to access its resources.

The grants are stored in a database table identified by the oauth_grants_table option (:oauth_grants by default). You can see an example of a db migration to create the grants table here

Attributes

An grant is identified by:

Application ID

The client application ID identifies the client application this grant is for.

Account ID (optional)

The account ID identifies the account of the resource owner (for grants which do not specify a resource owner, such as the client credentials grants, it is not used).

Type

• option: oauth_grants_type_column
• default: :type

Specifies the process by which the grant was established (i.e. authorization_code, implicit, client_credentials….)

Code

• option: oauth_grants_code_column
• default: :code

A unique code identifying the grant. For the authorization code grant, it is generated when the resource owner grants access to a client application. For the device code grant, it is used as the device code.

Expires In

• option: oauth_grants_expires_in_column
• default: :expires_in

The timestamp after which the grant can’t be used anymore.

Redirect URI

• option: oauth_grants_redirect_uri_column
• default: :redirect_uri

The redirect URI this grant’s code can be sent to.

Revoked At

• option: oauth_grants_revoked_at_column
• default: :revoked_at

The timestamp signaling if and when the grant was revoked.

Scopes

• option: oauth_grants_scopes_column
• default: :scopes

The permission scopes this grant will have access to.

Multiple scopes are stored as a whitespace-separated string.

They must match or be a subset of the scopes defined in the client application.

Access Type (default: “offline”, Access Type only)

• option: oauth_grants_access_type_column
• default: :access_type

When “offline”, the grant can be refreshed using a refresh token; when “online”, a new grant needs to be generated.

Access Token

• option: oauth_grants_token_hash_column

• default: :token

• option: oauth_grants_token_column
• default: :token

This column can be omitted when using the oauth_jwt feature.

Access tokens will be hashed before being stored, in the column pointed in oauth_grants_token_hash_column.

However, if you need to store access tokens in plain-text, you’ll have to set that to nil and define the column using oauth_grants_token_column:

oauth_grants_token_hash_column inl
oauth_grants_token_column :token

The access token associated to this grant.

Refresh Token

• option: oauth_grants_refresh_token_hash_column

• default: :refresh_token

• option: oauth_grants_refresh_token_column
• default: :refresh_token

Refresh tokens will be hashed before being stored, in the column pointed in oauth_grants_refresh_token_hash_column.

However, if you need to store refresh tokens in plain-text, you’ll have to set that to nil and define the column using oauth_grants_refresh_token_column:

oauth_grants_refresh_token_hash_column nil
oauth_grants_refresh_token_column :refresh_token

The refresh token associated to this grant.

Code challenge

This column can be omitted unless you’re using the oauth_pkce feature.

• option: oauth_grants_code_challenge_column
• default: :code_challenge

The PKCE code challenge associated to this grant.

Code challenge method

This column can be omitted unless you’re using the oauth_pkce feature.

• option: oauth_grants_code_challenge_method_column
• default: :code_challenge_method

The PKCE code challenge method associated to this grant (ex: "S256").

User code

This column can be omitted unless you’re using the oauth_device_code_grant feature.

• option: oauth_grants_user_code_column
• default: :user_code

The user code associated to this grant, as described in the Device Code Grant RFC.

last_polled_at

This column can be omitted unless you’re using the oauth_device_code_grant feature.

• option: oauth_grants_last_polled_at_column
• default: :last_polled_at

Stores the timestamp of the last time the token endpoint was polled, as described in the Device Code Grant RFC.

Resource

This column can be omitted unless you’re using the oauth_resource_indicators feature.

• option: oauth_grants_resource_column
• default: :resource

The resources this grant is asking access for.

Multiple scopes are stored as a whitespace-separated string.

Certificate Thumbprint

This column can be omitted unless you’re using the oauth_tls_client_auth feature with certificate-bound access tokens.

• option: oauth_grants_certificate_thumbprint_column
• default: :certificate_thumbprint

The thumbprint of the certificate used to generate this grant.

Home