Your new implementation does not work as intended

[gilles-crealp]

Sorry, but your new implementation (version 2) do not work as intended.

1. Optional parameters (like scope) are declared in data even if not set.
   The call oauth.clientCredentials(axios, 'https://example.com', 'foo', 'bar')() send grant_type=client_credentials&client_id=foo&client_secret=bar&scope= to the API.
2. The parameters of the function returned by your first function do not end up correctly in data.
   The call oauth.clientCredentials(axios, 'https://example.com', 'foo', 'bar')('baz') send 0=b&1=a&2=z&grant_type=client_credentials&client_id=foo&client_secret=bar&scope= to the API.

[compwright]

1. Optional parameters (like scope) are declared in data even if not set.
   The call oauth.clientCredentials(axios, 'https://example.com', 'foo', 'bar')() send grant_type=client_credentials&client_id=foo&client_secret=bar&scope= to the API.

Does this break things? An empty scope= parameter hasn't been an issue so far. What OAuth 2.0 implementation are you trying to use this with?

2. The parameters of the function returned by your first function do not end up correctly in data.
   The call oauth.clientCredentials(axios, 'https://example.com', 'foo', 'bar')('baz') send 0=b&1=a&2=z&grant_type=client_credentials&client_id=foo&client_secret=bar&scope= to the API.

You're not doing it right. Either include the scope as the last parameter to oauth.clientCredentials(), or as an property to the function that oauth.clientCredentials() returns. For example:

oauth.clientCredentials(axios, 'https://example.com', 'foo', 'bar', 'baz')()

will send grant_type=client_credentials&client_id=foo&client_secret=bar&scope=baz.

Or:

const getClientCredentials = oauth.clientCredentials(axios, 'https://example.com', 'foo', 'bar')
getClientCredentials({ scope: 'baz' })

will send grant_type=client_credentials&client_id=foo&client_secret=bar&scope=baz.

[gilles-crealp]

Does this break things? An empty scope= parameter hasn't been an issue so far.

Yes, returning an 400 Bad Request error on a OAuth 2.0 implementation that I do not own...

You're not doing it right.

Yes, I know. But you must update your README.md documentation. 😉

[compwright]

Resolved in v2.0.1

[gilles-crealp]

Thank you! 🚀