Authentication methods: How to use Client Credentials Grant

Question

I am trying to follow example 4 from the authentication documentation: https://developer.atlassian.com/bitbucket/api/2/reference/meta/authentication $ curl -X POST -u "client_id:secret" \ https://bitbucket.org/site/oauth2/access_token \ -d grant_type=client_credentials I have created an OAuth Consumer. I take the "Secret" that is generated from this Consumer and simply plug it in the example above for "secret", and I receive an "unauthorized client" result, when I expect to get back an access token.

Result: {"error_description": "Invalid OAuth client credentials", "error": "unauthorized_client"}% I have also ensured the consumer I have created as all permissions available. Am I plugging the wrong value into the secret section? Or what else could I be doing incorrectly?

Doug Walter · Answer

Thanks for the response.

I did see the username password approach under step 3 (https://developer.atlassian.com/bitbucket/api/2/reference/meta/authentication)

However, I was concerned that this method will not work when the user has two-step verification enabled.

balanici · Answer

curl -X POST -vu client_id:secret 'http://localhost:8080/api/oauth/token?username=userlogin&password=userpass&grant_type=password'

you'll get access_token in json object

Then you can access protected resource

curl -i -H "Authorization: Bearer your-token-here-4ODQ0NjUtZ-very-long-hash" http://localhost:8080/api/users/3