Passport: Why does an auth code client require a user id?

[rjmackay]

I might be completely misunderstanding but I don't see why an auth code client requires a user id? (when created through ./artisan oauth:client

I understand the auth code and then access tokens should be tied to a user, but it doesn't make sense to tie client to the user.

(Related: Why isn't a personal access client tied to a user?)

[hfmikep]

I use custom code to enter entries to oauth_clients and leave user_id null. I realize this is not an answer to your question, but just in case you were getting stuck somewhere I thought I would mention it.

[NastuzziSamy]

@rjmackay I think it's only to trace who made that key and also allow only that person to edit its name and its callback url

[rjmackay]

@hfmikep I'm doing similar. However this seems like something I shouldn't have to workaround.

[driesvints]

Because by default, oauth clients are associated with users who created them so they can use them for their 3rd party apps. If you just want an oauth client for one of your 1st party apps (like your mobile app) you can use, for example, password grant clients: https://laravel.com/docs/5.7/passport#password-grant-tokens

[robbieaverill]

Hi team, I'd just like to say that now that password and implicit grants are considered legacy, and recommend using auth code grant with PKCE instead, I had the same confusion as this issue highlights.

Recommending password grant instead is likely not to be a solution for much longer, if at all now.

[driesvints]

@robbieaverill this issue is two years old

[robbieaverill]

Yes, but is now relevant again =)