Authentication methods: How to use Client Credentials Grant

[Doug Walter]

I am trying to follow example 4 from the authentication documentation:

https://developer.atlassian.com/bitbucket/api/2/reference/meta/authentication

$ curl -X POST -u "client_id:secret" \
  https://bitbucket.org/site/oauth2/access_token \
  -d grant_type=client_credentials

I have created an OAuth Consumer. I take the "Secret" that is generated from this Consumer and simply plug it in the example above for "secret", and I receive an "unauthorized client" result, when I expect to get back an access token.



Result:

{"error_description": "Invalid OAuth client credentials", "error": "unauthorized_client"}%

 I have also ensured the consumer I have created as all permissions available. 

Am I plugging the wrong value into the secret section? Or what else could I be doing incorrectly? 

[balanici]

curl -X POST -vu client_id:secret 'http://localhost:8080/api/oauth/token?username=userlogin&password=userpass&grant_type=password'

you'll get access_token in json object

Then you can access protected resource

curl -i -H "Authorization: Bearer your-token-here-4ODQ0NjUtZ-very-long-hash" http://localhost:8080/api/users/3

[Doug Walter]

Thanks for the response.

I did see the username password approach under step 3 (https://developer.atlassian.com/bitbucket/api/2/reference/meta/authentication)

However, I was concerned that this method will not work when the user has two-step verification enabled.