title: OAuth 2.0 Flows for Microservice Architectures
body: <p>I'm trying to understand how to best apply the OAuth 2.0 grant types to a microservice architecture I am working on. Here's the situatation...</p>
  <p>I have a Single-Page Application/Mobile App acting as a client running in a web browser (browser acting as the user agent) or mobile phone. I use the <strong>Implicit Grant</strong> defined in <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.2" rel="nofollow noreferrer">RFC 6749, section 4.1</a> to authenticate a user and acquire an access token that the app uses to access some externally exposed API.</p>
  <p>The architecture I am dealing with is a collection of microservices that call on one another. For example, consider an externally exposed API <code>serviceA</code> and internal APIs <code>serviceB</code> and <code>serviceC</code>. Let's say <code>serviceA</code> depends on <code>serviceB</code> which subsequently depends on <code>serviceC</code> (<code>A</code> --&gt; <code>B</code> --&gt; <code>C</code>).</p>
  <p>My question is, what is the typical authorization flow for this situation? Is it standard to use Implicit Grant for the SPA to acquire an access token and then use the <strong>Client Credentials Grant</strong> defined in <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.4" rel="nofollow noreferrer">RFC 6749, section 4.4</a> to acquire an access token for the machine to machine interaction between <code>serviceB</code> and <code>serviceC</code>?</p>