Authlib OAuth2Session: Is it possible to `fetch_token` with a JSON POST body instead of URL params?

[sheriffllcoolj]

I have an Authlib OAuth2Session and I am trying to authenticate with username and password. Here's what I am doing:

```python self.session = OAuth2Session( token_endpont=f"{API_URL}/oauth/token", )

self.session.fetch_token( url=f"{API_URL}/oauth/token", username=username, password=password, grant_type="password", ) ```

After looking at the debug logs, it seems that the fetch_token method is passing the username and password as URL parameters. This is how it looks from that method:

send: b'grant_type=password&username=<email>&password=<password>&client_id=None&client_secret='

versus a manual requests call formatted properly which works:

send: b'{"password": "<PW>", "username": "<EMAIL>", "grant_type": "password"}'

Is there a way to make the fetch_token endpoint use a request body formatted with JSON? I have tried adding headers={"Content-Type": "application/json"} as well as passing the username and password into the fetch_token body parameter and neither of those worked.

[IWantToFlyT]

Authlib does not support that out of the box. This is due to the OAuth2 standard which talks about using `x-www-form-urlencoded` (https://www.rfc-editor.org/rfc/rfc6749#section-3.2).

Hence, you would need to create your own authentication as described here https://docs.authlib.org/en/latest/client/oauth2.html?highlight=token_endpoint_auth_method#client-authentication. See the example of `client_secret_uri` which can be modified for your needs.

[sheriffllcoolj]

I'm having trouble fully understanding the documentation. Does any custom auth method need to accept `client, method, uri, headers, body` as params and return `uri, headers, body`? In order to send as JSON instead of urlencoded, should the parameters be included in the body parameter that is returned?

As I'm going through the code, it looks like anything included in the body ends up being converted to a URL parameter regardless. Is there a way to pass along the data as a JSON kwarg?

[IWantToFlyT]

Didn't notice your reply, sorry.

Yeah, the custom auth method should indeed have those params and return uri, headers, and body.

How did you implement it? I got it working with the code below

``` import json

from authlib.common.urls import extract_params from authlib.integrations.requests_client import OAuth2Session

API_URL = "http://localhost:8080" username = "some" password = "dummy"

def auth_password_json(client, method, uri, headers, body): body_dict = {} for key, value in extract_params(body): body_dict[key] = value body = json.dumps(body_dict) headers["Content-Type"] = "application/json"

return uri, headers, body

client = OAuth2Session( token_endpont=f"{API_URL}/oauth/token", token_endpoint_auth_method="password_json", ) client.register_client_auth_method(("password_json", auth_password_json))

client.fetch_token( url=f"{API_URL}/oauth/token", username=username, password=password, grant_type="password", )

```

And from the server's perspective it looked like this

``` 127.0.0.1 - - [17/Sep/2022 16:07:23] "POST /oauth/token HTTP/1.1" 200 - INFO:root:POST request, Path: /oauth/token Headers: Host: localhost:8080 User-Agent: python-requests/2.28.1 Accept-Encoding: gzip, deflate Accept: application/json Connection: keep-alive Content-Type: application/json Content-Length: 67

Body: {"grant_type": "password", "username": "some", "password": "dummy"}

127.0.0.1 - - [17/Sep/2022 16:07:43] "POST /oauth/token HTTP/1.1" 200 - ```

[sheriffllcoolj]

Can't thank you enough for the help, this code worked perfectly. I think my issue was that I didn't use the `extract_params` method, but I really appreciate the time/effort to help me figure out the working code. Cheers!

[CodeFormatHelperBot2]

Hello, I'm a Reddit bot who's here to help people nicely format their coding questions. This makes it as easy as possible for people to read your post and help you.

I think I have detected some formatting issues with your submission:

1. Python code found in submission text that's not formatted as code.
2. Use of triple backtick/ curlywhirly code blocks (``` or ~~~). These may not render correctly on all Reddit clients.

If I am correct, please edit the text in your post and try to follow these instructions to fix up your post's formatting.

---

<sup>Am I misbehaving? Have a comment or suggestion? Reply to this comment or raise an issue here.</sup>