title: Django-OAuth-ToolKit : Generating access token's for multiple resources/services using client credentials grant type of OAuth2.0
body: <p>I have a couple of backend API's which are Django projects. They have a UI ( single page app) to it and a user name password based login.</p>
  <p>My clients are usually developers and they don't want the UI , all they want is the access to the backend API's and they can build their own dashboards etc. They would want to integrate the API's with their backend system's.</p>
  <p>Questions</p>
  <p>question 1. I am planning to use django-oauth-tool kit , it seems to me that the client credentials grant type would be suitable for this use case . Am I right ?</p>
  <p>To experiment , I started a seperate oauth server locally running on port 8000, I started the resource server ( r1 ) on 8001 and resource server ( r2 ) on 8002.</p>
  <p>step1 :</p>
  <p>I went to the admin panel of oauth server created a user u1 for resource r1 and user u2 for resource r2. I went to the applications module in admin panel registered r1 and r2 in the applications with grant type resource owner password . To generate the access token I called the token end point</p>
  <pre><code>POST -d &quot;grant_type=password&amp;username=u1&amp;password=u1password&quot; -u &quot;clientid of R1:clientsecre of fR1&quot; http://localhost:8000/o/token/
  </code></pre>
  <p>I got the access token</p>
  <pre class="lang-json prettyprint-override"><code>{
     &quot;access_token&quot;:&quot;KdAOMZBiMomVxpvjAWErwVGog6NRRH&quot;,
     &quot;expires_in&quot;:86400,
     &quot;token_type&quot;:&quot;Bearer&quot;,
     &quot;scope&quot;:&quot;read write introspection&quot;,
     &quot;refresh_token&quot;:&quot;ffgkZZ5NtVFh4REs0TbFAALNkJqXVQ&quot;
  }
  </code></pre>
  <p>step 2:</p>
  <p>Say the above access token I generated for Resource server R1 so I went to the settings file of R1 and added this token for introspection</p>
  <pre><code>OAUTH2_PROVIDER = {
      'RESOURCE_SERVER_INTROSPECTION_URL': 'http://localhost:8000/o/introspect/',
      'RESOURCE_SERVER_AUTH_TOKEN': '9b2uVud7WXHEdyolznvvkM3KwWfkVe',  # OR this but not both:
      #'RESOURCE_SERVER_INTROSPECTION_CREDENTIALS': ('5sRVXLoTQj9vlkLWaziIMZrgra1keupWIQ2On2hX','5jwMxls1JiAiQiNVnRTtbjmzgRO20FEHD0BBdiSAwvSL1XswZKqglDRke2L8Ig77ol7OE3ZdsA9SE7sry0u3BXwd1OvfFfhDVJFSLWlPG6g1vB3w4ZFc1g8ZwgzXJooc'),
  }
  </code></pre>
  <p>step 3:
  I did the same process for the resource server R2 as well.</p>
  <p>Question 2 : Is this process of registering multiple resource server's correct ? Have I set up the introspection correctly ?</p>
  <p>Question 3 : How would I register different micro services running on the same resource server ?</p>
  <p>step 4:
  Assuming that now I have a auth server ready to generate token for both r1 and r2 resources.</p>
  <p>Now to simulate a scenario where a developer who wants to integrate my API with his app wants to generate a access token would have to first register his app with the auth server , I registered an App ( developer's app) on auth server with Grant type client credentials.</p>
  <p>This how my admin panel looks now with R1 with user U1 and R2 with U2 registered as resource server's and developer app not associated with any user being the client who wants to access any of these resources.</p>
  <p><a href="https://i.stack.imgur.com/tFg3i.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tFg3i.png" alt="enter image description here" /></a></p>
  <p>step 5 :
  Simulating how a developer would have generated the access token ,  I generated the access token like this
  <a href="https://i.stack.imgur.com/t5LAm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/t5LAm.png" alt="enter image description here" /></a></p>
  <p>Note : I used the client Id and client secret of Resource R1 and generated the access token , but I am able to successfully use the same access token even for Resource R2 and its working.</p>
  <p>Question 3 : Why is the access token I generated using R1's client id and client secret working even for R2. Am I doing something wrong here ?
  Basically , I want to be able to produce access tokens for developer's specifically for a resource. I know there are scope and permissions but can I generate access token for a specific resource only ? what do I need to do to achieve this , do I need extend or add some logic ?</p>
  <p>Question 4 : Is my thought on using client credentials grant type correct and are the steps that I have done to register resources server's and the client app's which are going to use resource server's correct ?</p>
  <p>Thanks for any help</p>