Make your API public in production with OAuth 2

• OS: macOS
• Browser: Safari, Chrome... all
• Version: all
• Method of installation: dist
• Swagger-UI version: Swagger UI v5.11.3
• Swagger/OpenAPI version: Swagger 3.0, OpenAPI 3.1

Hello everyone,

This question does not concern any technical problem but just a question of practice.

Let me explain ;)

I want to expose my API to the public (NelmioApiDocBundle Symfony with Swagger) provided I have an OAuth 2.0 client with Authorization Code flow + PKCE registered in my authorization server.

I have a question regarding Swagger UI and the ability for users to test by clicking "Authorize".

My API only allows OAuth 2 authentication.

Should I create a Client just for the API or leave it free to enter the client ID.

The client has its own "redirect_uri" necessarily... will this work on the API documentation?

For my tests I implemented an oauth-redirect.html file. I think it is not necessary in production? The URI used will be the one registered for the client trying to connect?

I try to understand because I'm not going to configure 2 redirect-uris per client (one for its client application and one to test the API) ?

How to ensure you have the correct redirect uri from Client App. The input box does not exist ?

Thanks for your help,

Sébastien

Start by reviewing the OAuth 2 Authorization Code flow with PKCE and the mentioned oauth-redirect.html file in the context of Swagger UI. Clarify whether production API testing should use a dedicated client and redirect URI, and document the expected redirect URI behavior when the issue's questions have a decided answer.