# Web API authentication and authorization

**URL:** <https://forum.litium.com/t/web-api-authentication-and-authorization/3418>\
**Category:** Questions\
**Tags:** litium-8\
**Created:** [December 18, 2024, 9:01am UTC](https://forum.litium.com/t/web-api-authentication-and-authorization/3418 "2024-12-18T09:01:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattias](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@mattias](https://forum.litium.com/u/mattias)\
**Post date:** [December 18, 2024, 9:01am UTC](https://forum.litium.com/t/web-api-authentication-and-authorization/3418/1 "2024-12-18T09:01:26Z")

</div>

We have a scenario in which we have a separate application that needs to fetch information from a Litium web API. Some endpoints need to be secured and should only be accessible for signed in users. The documentation describes how to use service accounts and the /litium/oauth/token endpoint, but in this scenario, we need to be able to authenticate/authorize individual users (customers) and not a remote server.

I found a discussion in this forum from 2019 suggesting to use a service account together with the password grant flow. [oAuth JWT Client is invalid - Questions - Litium Forum](https://forum.litium.com/t/oauth-jwt-client-is-invalid/1070).

Today the password grant flow is legacy and not advised to use. [OAuth 2.0 Password Grant Type](https://oauth.net/2/grant-types/password/)

Is there any alternatives to the password grant when using the MVC Accelerator? For example, another OAuth flow? I can see that there are some settings in back office for each service account maybe indicating support for other flows but I haven’t found any information about this in the Litium docs.

Litium version: 8.19.1

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex030/uploads/litium/original/1X/12eddac3b8b661de1db86af10ac8151b571e6fb9.png) [@system](https://forum.litium.com/u/system)\
**Post date:** [January 15, 2025, 9:02am UTC](https://forum.litium.com/t/web-api-authentication-and-authorization/3418/2 "2025-01-15T09:02:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.