I have secured a REST API using OAuth 2.0 security, and I am not sure on how to configure security access using roles or scopes.There will be three types of clients:Public mobile app client used by end-users that can access theirprofile, data, etc. (using password grant type). By public I mean that the app is intended from any user and available to any user from Google Store, etc.)Non-public administration client used only from me for administrativepurposes that can access administrative services not allowed to beused by normal users (using client_credentials grant type).Non-public third-party client (using client_credentials grant type) that will use some services created specifically for them.Should I just create three different roles, User, Admin and ThirdPartyX and secure services with 'oauth2.clientHasRole' rules? Or should I create different scopes and do not care about roles? Is there a general rule of thumb on where would I use roles or scopes in general?
How to use OAuth 2.0 roles and scopes to secure services
oauth2