title: Sharing Access Token Between Clients
body: <p>I have an application that authenticates with Identity Server 4  using implicit flow.  The application is separated into two separate .net core applications.  One application handles the back end and the other handles serving the front end. </p>
  
  <p>The back end and front end share the same scopes, api name, and authority settings.</p>
  
  <p>I will be writing an integration with a 3rd party.  Our back end application will call into the 3rd party application.  We need to ensure that calls to the 3rd party application are authenticated.  I'd like to share the access token the back end application receives from the front end and send that to the 3rd party application.  I am not quite sure of the setup required to do this.</p>
  
  <p>I thought that I could add a new Client to Identity Server and set it up with only the needed scopes required by the 3rd party.  But in my local testing, I haven't been able to get this to work.  I get an error IDX10804 Unable to obtain configuration from .../.well-known/openid-configuration - A security error occurred.</p>
  
  <p>My config looks like:</p>
  
  <pre><code>            new Client
              {
                  ClientId = "thirdPartyClient",
                  ClientName = "thirdPartyClient",
                  AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                  ClientSecrets =
                  {
                      new Secret("secret".Sha256())
                  },
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      IdentityServerConstants.StandardScopes.Email
                  },
  
                  AllowOfflineAccess = true,
                  AllowAccessTokensViaBrowser = true,
                  RequireConsent = false
              },
  
              new Client
              {
                  ClientId = "myapplication",
                  ClientName = "myapplication",
                  AllowedGrantTypes = GrantTypes.Implicit,
                  ClientSecrets =
                  {
                      new Secret("secret".Sha256())
                  },
  
  
                  RedirectUris = { "https://.../callback.html" },
                  PostLogoutRedirectUris = { "https://.../index.html"
                  AllowedCorsOrigins = { "https://..." },
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      IdentityServerConstants.StandardScopes.Email,
                      IdentityServerConstants.StandardScopes.Address,
                      "myscope",
                  },
  
                  AllowOfflineAccess = true,
                  AllowAccessTokensViaBrowser = true,
                  RequireConsent = false
              }
  </code></pre>
  
  <p>Am I going about this the right way?</p>