OAuth2Session refresh token default arguments about requests-oauthlib

[dasevilla]

The common case is that the client credentials are needed when using the refresh token. From Section 6:

If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in Section 3.2.1.

The client credentials are either passed in an Authorization header or in the request body. See Client Authentication.

Google says to pass using the request body. The spec recommends not passing them this way.

Letting the developer choose seems best. Similar to the signature_type parameter of OAuth1.

[ib-lundgren]

Indeed but which credentials are needed is undefined and my thoughts were that if we can find that the majority uses say, client_id and client_secret, in the request body whereas the others don't use the credentials at all. Then we could possibly default to include client_id and client_secret by default when refreshing the token if these were passed to the OAuth2Session constructor. The developer should always be able to choose but it would be nice if we could provide sane defaults.

[Lukasa]

This is the problem with OAuth2: it's sufficiently complicated that we risk having the API get seriously overcomplicated. I'm strongly inclined to make a decision based on what users are likely to need and hard-code that, then let users subclass if they need to change it.

[ib-lundgren]

Agreed. My thoughts were that if, through happy coincident we notice that

60% require client_id and client_secret.
10% require Basic auth.
10% require secret_key and key_type

and none of these overlap. Then we could add these parameters by default if present in the OAuth2Sessuib constructor. That said, this is likely not the case and might just add too much complexity. But if someone is up for doing this research I it might be valuable =)

I think sub classing to provide the various extra args is a good way to go for users and will make a note somewhere to add this to the documentation.

[ib-lundgren]

Thought a little about this. Better have customizing wrappers rather than tricky/magic logic trying to determine what to send.