title: How to get a authentication code / token using Authlib 2.0 on Flask?
body: <p>I have read part of the documentation of <a href="https://authlib.org" rel="nofollow noreferrer">Authlib</a> and the <a href="https://github.com/authlib/example-oauth2-server" rel="nofollow noreferrer">example</a> multiple times, I also have read articles about the concept of <a href="https://dev.to/anabella/dancing-with-oauth-emp" rel="nofollow noreferrer">Auth 2.0</a>, but I can't figure out how to do it. I want my user to make login (Using username and password) and then my application to return a token. After that the user can use the private resources <code>@require_oauth('profile')</code>.</p>
  
  <p>My client :</p>
  
  <pre><code>*************************** 1. row ***************************
                   client_id: wmahDfsran1jk6CaH1knpi3n
               client_secret: mnr4j15pZurBPYHq4KW4LY8HC7pS4TwjzMlJAUGmo7Bpy5gP
                   issued_at: 1531271519
                  expires_at: 0
                redirect_uri: http://127.0.0.1:5000/oauth/token
  token_endpoint_auth_method: client_secret_basic
                  grant_type: authorization_code password
               response_type: code
                       scope: profile
                 client_name: client_test
                  client_uri: http://127.0.0.1:5000/
                    logo_uri: NULL
                     contact: NULL
                     tos_uri: NULL
                  policy_uri: NULL
                    jwks_uri: NULL
                   jwks_text: NULL
               i18n_metadata: NULL
                 software_id: NULL
            software_version: NULL
                          id: 2
                     user_id: 1
  </code></pre>
  
  <p>My POST request (Using <a href="https://www.getpostman.com" rel="nofollow noreferrer">Postman</a>):</p>
  
  <pre><code>http://127.0.0.1:5000/oauth/authorize?response_type=code&amp;client_id=wmahDfsran1jk6CaH1knpi3n
  </code></pre>
  
  <p>The error after make the request :</p>
  
  <pre><code>{
      "error": "invalid_grant"
  }
  </code></pre>
  
  <p>Authorize :</p>
  
  <pre><code>@routes.route('/oauth/authorize', methods=['GET', 'POST'])
  def authorize():  
      user = current_user()
  
      try:
          grant = authorization.validate_consent_request(end_user=user)
      except OAuth2Error as error:
          return error.error
  
      return authorization.create_authorization_response(grant_user=user)
  </code></pre>
  
  <p>Token :</p>
  
  <pre><code>@routes.route('/oauth/token', methods=['POST', 'GET'])
  def issue_token():
      return authorization.create_token_response()
  </code></pre>
  
  <p>Profile :</p>
  
  <pre><code>@routes.route('/resource/profile', methods=['GET', 'POST'])
  @require_oauth('profile')
  def profile():
      user = current_user()
  
      return jsonify(id=user.id, username=user.username, secret=user.secret, client_id=user.client_id)
  </code></pre>
  
  <p>The token continues the same of the Auth Example.</p>
  
  <p>If I try to access <code>/resource/profile</code> without a token / autorização :</p>
  
  <pre><code>{"error": "missing_authorization", "error_description": "Missing \"Authorization\" in headers."}
  </code></pre>
  
  <p>How can I fix it ?</p>
  
  <p>Obs : After I fixed up this, how can I get the Auth Token and send on header to <code>/resource/profile</code> ?</p>
  
  <p>Another references : <a href="https://docs.microsoft.com/pt-br/azure/active-directory/develop/active-directory-protocols-oauth-code" rel="nofollow noreferrer">Authorize access to Azure Active Directory web applications using the OAuth 2.0 code grant flow</a><strong>,</strong> <a href="https://www.youtube.com/watch?v=CPbvxxslDTU" rel="nofollow noreferrer">OAuth 2.0: An Overview</a><strong>,</strong> <a href="https://stackoverflow.com/questions/10576386/invalid-grant-trying-to-get-oauth-token-from-google">invalid_grant trying to get oAuth token from google
  Ask</a><strong>,</strong> <a href="https://stackoverflow.com/questions/26400776/circumstances-of-the-invalid-grant-error-when-refreshing-an-access-token">Circumstances of the “invalid_grant” error when refreshing an access token?
  </a><strong>,</strong> <a href="https://stackoverflow.com/questions/46956952/authorization-code-grant-return-invalid-grant">Authorization Code Grant return invalid_grant
  </a> ...</p>