# Lock UI & Implicit Grant

**URL:** <https://community.auth0.com/t/lock-ui-implicit-grant/6912>\
**Category:** Get Help\
**Tags:** spa, implicit-grant, lock\
**Created:** [June 5, 2017, 9:29pm UTC](https://community.auth0.com/t/lock-ui-implicit-grant/6912 "2017-06-05T21:29:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![brianra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/brianra/32/11261_2.png) [@brianra](https://community.auth0.com/u/brianra)\
**Post date:** [June 5, 2017, 9:29pm UTC](https://community.auth0.com/t/lock-ui-implicit-grant/6912/1 "2017-06-05T21:29:47Z")

</div>

I’m using the Lock UI (not hosted login page) with a SPA. I’m using the Angular 2 quickstart as an example.

It looks like this defaults to using the username-password grant type by default, and not the implicit grant. The reason I say this is when calling `lock.show()` and logging in, the request hits `/oauth/token` with a grant\_type of `http://auth0.com/oauth/grant-type/password-realm`. Since this is a SPA (Angular 2), I was anticipating it’d hit the `/authorize` endpoint. Is there a way to force the lock UI to know this is an implicit grant flow? Here’s my lock config setup (similar to Angular 2 (SPA) quickstart).

```
    this.lock = new Auth0Lock(auth0SPAConfig.clientID, auth0SPAConfig.domain, {
      oidcConformant: true,
      autoclose: true,
      auth: {
        redirectUrl: auth0SPAConfig.redirectUri,
        responseType: 'token id_token',
        audience: auth0SPAConfig.audience,
        params: {
          scope: 'openid profile last_password_reset'
        }
      }
    });

```

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [June 6, 2017, 4:31pm UTC](https://community.auth0.com/t/lock-ui-implicit-grant/6912/2 "2017-06-06T16:31:03Z")

</div>

At this time the use of Lock in conjunction with API authorization (aka audience parameter) within your own client application is not yet documented so you should not rely on that as it’s subject to changes before being documented.

The supported mechanism at this time to make use of API authorization is to use Auth0.js v8 and go through the hosted login page. As you may have noticed by the fact that Lock already has some undocumented parameters related to API authorization there is work in progress to enable also the scenario you mention, however, this is not yet completed and documented.

---

<div class="post-metadata">

**Author:** ![brianra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/brianra/32/11261_2.png) [@brianra](https://community.auth0.com/u/brianra)\
**Post date:** [June 6, 2017, 6:58pm UTC](https://community.auth0.com/t/lock-ui-implicit-grant/6912/3 "2017-06-06T18:58:19Z")

</div>

Thanks! I’ll use auth0.js v8 then.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:54am UTC](https://community.auth0.com/t/lock-ui-implicit-grant/6912/4 "2018-03-02T05:54:23Z")

</div>