How to determine grant type of an access token

[hughpv]

Short version: Given a token, how do I determine the grant type? Is it possible to add a gty claim like I see in Auth0 client credentials grants?

Longer version:
For the moment, I'm using Auth0 for Internet-facing user authorization code grants and Hydra behind the firewall for our internal services to use client credentials grants.

Our server-side code that interprets the token needs to figure out whether it's interacting with a user or a machine; for the moment, we can just use the iss because an Auth0 issuer means it's a user and our Hydra issuer means it's a machine.

But I'm wondering about the day if/when I need to support client credentials grants publicly. Naturally, exposing our Hydra server to the Internet is an option but brings with it certain responsibilities. We already use Auth0 publicly for users; it would be natural to consider using it for Internet-facing machine-to-machine flows. If we did that, my iss "hack" would break down.

Now I see that client credentials tokens issued by Auth0 include a gty (grant type) claim of client_credentials -- is there any way to make Hydra include this claim as well?

Or is there another (better) way to figure out what sort of grant a token represents?

Thanks!

[aeneasr]

For client credentials, the client_id equals the sub during introspection. For all other flows, these two values are different. There are no other indicators for that at the moment.

[hughpv]

Thanks! But that does make me wonder if I'm doing something wrong; like maybe I'm asking the wrong question. Is it odd to be interested in determining the grant type?

[vinckr]

From what I could gather the way they do it in Auth0 is their approach but it is not mandatory from the OAuth2 spec.

You could look into using Kratos for user AuthN, that would probably eliminate some of the complexity of interfacing.

We are also launching a SaaS service of the Ory products with some benefits in that direction, feel free to reach out if that is interesting/ an option to you 😉.

[hughpv]

I'm going to accept this answer from @aeneasr as essentially saying "you can't, unless the only issuer you're accepting tokens from is Hydra (in which case client_id == sub implies a client credentials grant)."