title: Implementing OAuth 2.0 authentication with a Laravel API
body: <p>I'm currently building a web application which is an AngularJS frontend that communicates with a RESTful API built using Laravel. I'm making good progress, but finding it hard to get my head around how to handle user authentication.</p>
  
  <p>I've been advised that I should be using OAuth for authentication, and I've decided to use it seen as it could be a learning experience for me as well. The package I'm using to handle this is <a href="https://github.com/lucadegasperi/oauth2-server-laravel">oauth2-server-laravel</a>.</p>
  
  <p>The basic user story is that users can register their username/password combination for the application, and they then log into the application with that same username and password. They're only authenticated by their username and password, and not by any client secret. After login, they should be given an access token which will be send along with every future request to authenticate them on different API endpoints.</p>
  
  <p>The OAuth2 library has a "password flow" grant type which seems to be what I need, however it also takes <code>client_id</code> and <code>client_secret</code> parameters, which I don't want. The request URI is something like this:</p>
  
  <pre><code>POST https://www.example.com/oauth/access_token?
  grant_type=password&amp;
  client_id=the_client_id&amp;
  client_secret=the_client_secret&amp;
  username=the_username&amp;
  password=the_password&amp;
  scope=scope1,scope2&amp;
  state=123456789
  </code></pre>
  
  <p>But what I want is just:</p>
  
  <pre><code>POST https://www.example.com/oauth/access_token?
  grant_type=password&amp;
  username=the_username&amp;
  password=the_password
  </code></pre>
  
  <p>How am I meant to provide a client ID and secret of a user that has yet to authenticate?</p>
  
  <p>Is there a different grant I can be using, or is what I want to achieve just not suited for OAuth at all?</p>