Is it possible to use OAuth 2.0 without a redirect server?

Question

I'm trying to create a local Java-based client that interacts with the SurveyMonkey API.

SurveyMonkey requires a long-lived access token using OAuth 2.0, which I'm not very familiar with.

I've been googling this for hours, and I think the answer is no, but I just want to be sure:

Is it possible for me to write a simple Java client that interacts with the SurveyMonkey, without setting up my own redirect server in some cloud?

I feel like having my own online service is mandatory to be able to receive the bearer tokens generated by OAuth 2.0. Is it possible that I can't have SurveyMonkey send bearer tokens directly to my client?

And if I were to set up my own custom Servlet somewhere, and use it as a redirect_uri, then the correct flow would be as follows:

1. Java-client request bearer token from SurveyMonkey, with redirect_uri being my own custom servlet URL.
2. SurveyMonkey sends token to my custom servlet URL.
3. Java-client polls custom servlet URL until a token is available?

Is this correct?

Answer 1

Yes, it is possible to use OAuth2 without a callback URL. The RFC6749 introduces several flows. The Implicit and Authorization Code grant types require a redirect URI. However the Resource Owner Password Credentials grant type does not.

Since RFC6749, other specifications have been issued that do not require any redirect URI:

• RFC7522: Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants
• RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
• RFC8628: OAuth 2.0 Device Authorization Grant

In any case, if the grant types above do not fit on your needs, nothing prevent you from creating a custom grant type.

Answer 2

Not exactly, the whole point of the OAuth flow is that the user (the client you're accessing the data on behalf of) needs to give you permission to access their data.

See the authentication instructions. You need to send the user to the OAuth authorize page:

https://api.surveymonkey.net/oauth/authorize?api_key<your_key>&client_id=<your_client_id>&response_type=code&redirect_uri=<your_redirect_uri> 

This will show a page to the user telling them which parts of their account you are requesting access to (ex. see their surveys, see their responses, etc). Once the user approves that by clicking "Authorize" on that page, SurveyMonkey will automatically go to whatever you set as your redirect URI (make sure the one from the url above matches with what you set in the settings for your app) with the code.

So if your redirect URL was https://example.com/surveymonkey/oauth, SurveyMonkey will redirect the user to that URL with a code:

https://example.com/surveymonkey/oauth?code=<auth_code>

You need to take that code and then exchange it for an access token by doing a POST request to https://api.surveymonkey.net/oauth/token?api_key=<your_api_key> with the following post params:

client_secret=<your_secret> code=<auth_code_you_just_got> redirect_uri=<same_redirect_uri_as_before> grant_type=authorization_code 

This will return an access token, you can then use that access token to access data on the user's account. You don't give the access token to the user it's for you to use to access the user's account. No need for polling or anything.

If you're just accessing your own account, you can use the access token provided in the settings page of your app. Otherwise there's no way to get an access token for a user without setting up your own redirect server (unless all the users are in the same group as you, i.e. multiple users under the same account; but I won't get into that). SurveyMonkey needs a place to send you the code once the user authorizes, you can't just request one.