title: What oAuth2 Grant should I use for AngularJS secure site that pulls from an API
body: <p>I am looking for suggestions on best strategy with this project.</p>
  
  <p>I am building a SaaS service in which a client (tenant) may be able to access the service using an iPad app or the service website. The service website is to be written in AngularJS and laravel. Authorization is to be oAuth 2. Users logging into the website will have different roles for and different abilities. In the future we may expand services and apps, all using the same user accounts.</p>
  
  <p>I am having problems working out a good authentication and authorization strategy for the services website. Since the website will run AngularJS and will connect to our own services API, I am not sure what the best way would be to handle AUTH for the user and also AngularJS. I understand that the iPad app probably will use something like "Resource Owners Grant", but what about the AngularJS website and code? Should it use "Implicit Grant", "JWT" or something else? When a user logs in, should they be given a TOKEN that authorizes all the pages on the AngularJS website? If so, do I use something like "Authorization Code Grant" and automatically authorize the request without doing some sort of redirect for the user ?</p>
  
  <p>I am also considering having a "login.php" page that authorizes the user and gives the token. It could embed the users profile on the "angularjs" page and if the AngularJS page doesn't have the embedded profile, it redirects to login. But with this solution, I am still trying to figure out how to best securely connect the AngularJS page to the API.</p>
  
  <p>I am quite confused since the AngularJS website is more or less an interface for our API. But I don't think the user should have to go through the "request authentication" process, they should just log in..</p>
  
  <p>Thanks for any suggestions or direction.. -John</p>