<commit_before>---
description: Learn how to implement the OAuth 2.0 Resource Owner Password Grant
toc: true
topics:
  - api-authentication
  - oidc
  - resource-owner-password
contentType: tutorial
useCase:
  - secure-api
  - call-api
---
# Implement the Resource Owner Password Grant

<%= include('../_includes/_ropg-warning') %>

In this tutorial, we will go through the steps required to implement the Resource Owner Password Grant flow.

## Before you start

* Check that your application's [grant type property](/applications/concepts/application-grant-types) is set appropriately.
* [Register the API](/apis#how-to-configure-an-api-in-auth0) with Auth0.
* Check that the [Default Audience and/or Default Directory](/dashboard/reference/settings-tenant#api-authorization-settings) has been set appropriately.
* Update or disable any [rules](/rules), such as rules that deny access based on an email domain whitelist, so they only impact specific connections. If you get an `'access_denied'` error when testing the Password Grant, this could be due to an access control rule.

## Configure your tenant

The Password Grant relies on a connection capable of authenticating users via username and password. In order to indicate which connection the Password Grant should use you need to set the value of the `default_directory` tenant setting.

1. Open the [Dashboard](${manage_url}) and browse to your [Tenant Settings](${manage_url}/#/tenant).
1. Scroll down to the __Settings__ section and locate the __Default Directory__ setting.
1. Enter the name of the connection you would like to use. Keep in mind that only connections capable of authenticating users via username and password can be used (such as database connections, AD, LDAP, Windows Azure AD, ADFS)

![Update Default Directory](/media/articles/api-auth/default-directory-setting.png)

## Ask for a Token

In order to execute the flow the application needs to acquire the Resource Owner's credentials, usually this will be through the use of an interactive form. Once the application has the credentials it needs to forward them to Auth0 with a `POST` to the [/oauth/token endpoint of Auth0's Authentication API](/api/authentication#resource-owner-password).

```har
{
  "method": "POST",
  "url": "https://${account.namespace}/oauth/token",
  "headers": [
    { "name": "Content-Type", "value": "application/x-www-form-urlencoded" }
  ],
  "postData": {
    "mimeType": "application/x-www-form-urlencoded",<commit_msg>Update password grant before you start info<commit_after>---
description: Learn how to implement the OAuth 2.0 Resource Owner Password Grant
toc: true
topics:
  - api-authentication
  - oidc
  - resource-owner-password
contentType: tutorial
useCase:
  - secure-api
  - call-api
---
# Implement the Resource Owner Password Grant

<%= include('../_includes/_ropg-warning') %>

In this tutorial, we will go through the steps required to implement the Resource Owner Password Grant flow.

## Before you start

* Check that your application's grant type is set to "Password". To set an application's grant type:
  1. Go to the [Dashboard](${manage_url}) and select **Applications**
  2. Choose your application from the list
  3. On the **Settings** page scroll down to **Advanced Settings**
  4. Select the **Grant Types** tab
  5. Enable the "Password" grant
* [Register the API](/apis#how-to-configure-an-api-in-auth0) with Auth0.
* Update or disable any [rules](/rules) so they only impact specific connections. If you get an `'access_denied'` error when testing the Password Grant, this could be due to an access control rule.

## Configure your tenant

The Password Grant relies on a connection capable of authenticating users via username and password. In order to indicate which connection the Password Grant should use you need to set the value of the `default_directory` tenant setting.

1. Open the [Dashboard](${manage_url}) and browse to your [Tenant Settings](${manage_url}/#/tenant).
1. Scroll down to the __Settings__ section and locate the __Default Directory__ setting.
1. Enter the name of the connection you would like to use. Keep in mind that only connections capable of authenticating users via username and password can be used (such as database connections, AD, LDAP, Windows Azure AD, ADFS)

![Update Default Directory](/media/articles/api-auth/default-directory-setting.png)

## Ask for a Token

In order to execute the flow the application needs to acquire the Resource Owner's credentials, usually this will be through the use of an interactive form. Once the application has the credentials it needs to forward them to Auth0 with a `POST` to the [/oauth/token endpoint of Auth0's Authentication API](/api/authentication#resource-owner-password).

```har
{
  "method": "POST",
  "url": "https://${account.namespace}/oauth/token",
  "headers": [
    { "name": "Content-Type", "value": "application/x-www-form-urlencoded" }
  ],
  "postData": {
    "mimeType": "application/x-www-form-urlencoded",
{'fraction_non_alphanumeric': 0.0937250199840128, 'fraction_numerical': 0.004596322941646682, 'mean_word_length': 4.5, 'pattern_counts': {'":': 14, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7049835', 'n_tokens_mistral': 1387, 'n_tokens_neox': 1322, 'n_words': 611}