Spa oauth flow without user authentication prompt

[ty.frith]

Hey there @tojeffraymond welcome to the community!

@tojeffraymond

Is there an oauth flow the SPA could use (via Auth0) that doesn’t require any user authentication and allows the app to authenticate to get a JWT token? Thus, the application could pass directly to the API GW without having to go through a custom authentication middleware in Netlity.

Interesting use case, I haven’t heard of anything similar personally. The only flow that wouldn’t require any user authentication is m2m. You could proxy a client credentials exchange through a backend via a SPA so that the credentials are handled on a backend and safe.

It’s fairly common for SPAs to proxy calls through a backend to call the Management API for example.This typically involves an authenticated user but I don’t see any reason you could handle this on a backend with an unauthenticated user. Here’s an FAQ that goes into this set up:

https://community.auth0.com/t/how-can-i-enable-users-to-change-their-email-address-from-a-spa-or-native-app/44064#the-following-diagram-describes-our-desired-flow-3

Not entirely sure that answers your question, but hope it at least gives some direction!