To initiate the process, the client application will redirect the user to the authorization endpoint. This redirect will contain the applicable attributes URL encoded and included in the query string component of the URL.

Using the above parameters as an example, the application will redirect the user to the following URL: 


https://localhost:9031/as/authorization.oauth2?client_id=im_client&response_type=token&scope=edit&redirect_uri=sample%3A%2F%2Foauth2%2Fimplicit%2Fcb

This will initiate an authentication process using the browser (user agent). Once the user has authenticated and approved the authorization request they will be redirected to the configured URI with the access token included as a fragment of the URL. A refresh token will NOT be returned to the client: 


sample://oauth2/implicit/cb#access_token=zzz...yyy&token_type=bearer&expires_in=14400
Note:
  • For mobile scenarios, the redirect_uri may be a custom URL scheme which will cause the access token to be returned to the native application.
  • The implicit response is returned via a URL fragment. The fragment is only visible from client-side code. Therefore if you need to parse the values from server-side code, you must post the values to the server for parsing.