# Legacy OAuth Implicit and Password Grants

Learn how the legacy OAuth Implicit and Password grants work in FusionAuth, for existing integrations.

> For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt)

FusionAuth supports the Implicit grant and the Password grant for existing integrations. Both grants expose tokens or passwords to more parties than the [Authorization Code grant](https://fusionauth.io/docs/authentication/oauth/authorization-code.md) does. Use the Authorization Code grant for new apps.

## Implicit Grant

Caution

The Implicit grant returns the access token in the URL fragment, where the token can leak through browser history. The browser also has no safe place to store the token.

The Implicit grant skips the code exchange. FusionAuth returns the access token in the redirect from the authorize endpoint. To use the Implicit grant, enable `Implicit` in **Enabled grants** on the OAuth tab of the Application.

### Send the Browser to the Authorize Endpoint

Redirect the browser to the `/oauth2/authorize` endpoint with **`response_type`** set to `token`. The example adds line breaks for readability.

Example HTTP Request

```plaintext
GET /oauth2/authorize?
      client_id=06494b74-a796-4723-af44-1bdb96b48875
      &redirect_uri=https%3A%2F%2Fwww.piedpiper.com%2Fcallback
      &response_type=token
Host: piedpiper.fusionauth.io
```

After the user logs in, FusionAuth redirects the browser to the **`redirect_uri`**. The parameters, including the **`access_token`**, follow the `#` fragment delimiter:

Example HTTP Redirect Response

```plaintext
HTTP/1.1 302 Found
Location: https://www.piedpiper.com/callback#
           access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo
           &expires_in=3599
           &iss=https%3A%2F%2Fpiedpiper.fusionauth.io
           &locale=en
           &token_type=Bearer
           &userState=Authenticated
```

For every parameter, see the [Implicit grant request](https://fusionauth.io/docs/apis/oauth/authorize.md#implicit-grant-request).

## Password Grant

Caution

With the Password grant, your app collects the user's password and sends the password to FusionAuth. The user also can't log in with FusionAuth features such as social login.

The Resource Owner Password Credentials grant, also called the Password grant, exchanges the user's login Id and password for tokens. To use the Password grant, enable `Password` in **Enabled grants** on the OAuth tab of the Application.

### Exchange the User's Credentials for Tokens

Send the login Id and the password to the `/oauth2/token` endpoint with **`grant_type`** set to `password`. To get a refresh token, add `offline_access` to **`scope`**. The example logs in `richard@piedpiper.com` with the password `disrupt`, and adds line breaks for readability.

Example HTTP Request

```plaintext
POST /oauth2/token HTTP/1.1
Host: piedpiper.fusionauth.io
Content-Type: application/x-www-form-urlencoded

client_id=06494b74-a796-4723-af44-1bdb96b48875
    &client_secret=example-client-secret-do-not-use
    &grant_type=password
    &password=disrupt
    &scope=offline_access
    &username=richard%40piedpiper.com
```

FusionAuth returns the tokens:

Example JSON Response

```json
{
  "access_token" : "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODUxNDA5ODQsImlhdCI6MTQ4NTEzNzM4NCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiIyOWFjMGMxOC0wYjRhLTQyY2YtODJmYy0wM2Q1NzAzMThhMWQiLCJhcHBsaWNhdGlvbklkIjoiNzkxMDM3MzQtOTdhYi00ZDFhLWFmMzctZTAwNmQwNWQyOTUyIiwicm9sZXMiOltdfQ.Mp0Pcwsz5VECK11Kf2ZZNF_SMKu5CgBeLN9ZOP04kZo",
  "expires_in" : 3600,
  "refresh_token": "ze9fi6Y9sMSf3yWp3aaO2w7AMav2MFdiMIi2GObrAi-i3248oo0jTQ",
  "scope": "offline_access",
  "token_type" : "Bearer",
  "userId" : "3b6d2f70-4821-4694-ac89-60333c9c4165"
}
```

Replace `example-client-secret-do-not-use` with the **Client secret** from the OAuth tab of your Application. When the **Client Authentication** of the Application is `Not required`, leave out **`client_secret`**. For when each grant needs the secret, see the [Client Secret Reference](https://fusionauth.io/docs/apis/oauth/client-secret.md). For every field, see the [Password grant request](https://fusionauth.io/docs/apis/oauth/token.md#resource-owner-password-credentials-grant-request).

Related

[Authentication OAuth Authorization Code Grant Learn how to log users in with the OAuth Authorization Code grant and PKCE. oauthoauth2](https://fusionauth.io/docs/authentication/oauth/authorization-code.md)

[Authentication OAuth Client Credentials Grant Learn how to get an access token for machine-to-machine requests with the OAuth Client Credentials grant. oauthoauth2](https://fusionauth.io/docs/authentication/oauth/client-credentials.md)

[Authentication OAuth Device Authorization Grant Learn how to log users in on TVs and other input-constrained devices with the OAuth Device Authorization grant. oauthoauth2](https://fusionauth.io/docs/authentication/oauth/device.md)

[Authentication OAuth Learn about the OAuth 2.0 and OpenID Connect grants FusionAuth supports for login and single sign-on. oauthoauth2](https://fusionauth.io/docs/authentication/oauth.md)
---

## Other pages in OAuth

> For the full index of this section, see [Authentication](https://fusionauth.io/docs/llms-authentication.txt).

- [Add FusionAuth Login to an App You Build](https://fusionauth.io/docs/authentication/oauth/add-login-to-your-app.md): Learn how to add FusionAuth login to a web, mobile, or single-page app you build with an OpenID Connect library and the OAuth Authorization Code grant.
- [OAuth Authorization Code Grant](https://fusionauth.io/docs/authentication/oauth/authorization-code.md): Learn how to log users in with the OAuth Authorization Code grant and PKCE.
- [CIMD Registration Caching And Lifecycle](https://fusionauth.io/docs/authentication/oauth/cimd-registration-lifecycle.md): Learn how long FusionAuth caches a Client ID Metadata Document, what happens when it expires, and how a CIMD client registration is refreshed or removed.
- [OAuth Client Credentials Grant](https://fusionauth.io/docs/authentication/oauth/client-credentials.md): Learn how to get an access token for machine-to-machine requests with the OAuth Client Credentials grant.
- [OAuth Client Registration | Static and CIMD](https://fusionauth.io/docs/authentication/oauth/client-registration.md): Learn how FusionAuth registers OAuth clients, either ahead of time as Applications or just-in-time from a Client ID Metadata Document.
- [OAuth Device Authorization Grant](https://fusionauth.io/docs/authentication/oauth/device.md): Learn how to log users in on TVs and other input-constrained devices with the OAuth Device Authorization grant.
- [Use DPoP In A Browser App](https://fusionauth.io/docs/authentication/oauth/dpop/browser-app.md): Learn how to bind tokens to the browser with DPoP using the FusionAuth React, Angular, or Vue SDK.
- [Demonstrating Proof-of-Possession (DPoP)](https://fusionauth.io/docs/authentication/oauth/dpop.md): Learn how DPoP binds FusionAuth access and refresh tokens to a key pair that only your client holds.
- [Validate DPoP Requests In Your API](https://fusionauth.io/docs/authentication/oauth/dpop/validate-requests.md): Learn how to check DPoP proofs and DPoP-bound FusionAuth access tokens in your API.
- [Host A Client ID Metadata Document (CIMD)](https://fusionauth.io/docs/authentication/oauth/host-cimd-document.md): Publish a Client ID Metadata Document so your OAuth client can log in to FusionAuth without being registered ahead of time.
- [OAuth](https://fusionauth.io/docs/authentication/oauth.md): Learn about the OAuth 2.0 and OpenID Connect grants FusionAuth supports for login and single sign-on.
- [OAuth Issuer Validation](https://fusionauth.io/docs/authentication/oauth/issuer-validation.md): Learn how to validate the authorization response issuer parameter (RFC 9207) to prevent mix-up attacks.
- [Connect claude.ai And chatgpt.com To A FusionAuth-Protected MCP Server](https://fusionauth.io/docs/authentication/oauth/mcp-clients-claude-chatgpt.md): Learn how to connect claude.ai and chatgpt.com to an MCP server protected by FusionAuth using Client ID Metadata Documents.
- [Modes](https://fusionauth.io/docs/authentication/oauth/modes.md): Learn about the eight common ways apps use OAuth and OpenID Connect.
- [OIDC Prompt](https://fusionauth.io/docs/authentication/oauth/prompt.md): Learn about OpenID Connect prompt and example use cases.
- [OAuth Refresh Token Grant](https://fusionauth.io/docs/authentication/oauth/refresh-token.md): Learn how to exchange a refresh token for a new access token with the OAuth Refresh Token grant.
- [OAuth Response Modes](https://fusionauth.io/docs/authentication/oauth/response-modes.md): Learn about OAuth 2.0 response modes (query, fragment, form_post) and when to use each one.
- [Manage Software Tokens](https://fusionauth.io/docs/authentication/oauth/tokens.md): Learn about OAuth2 and OpenID Connect Tokens and how they are used.
- [URL Validation](https://fusionauth.io/docs/authentication/oauth/url-validation.md): Learn about OAuth URL validation policies in FusionAuth.