I’ve implemented the client credentials authentication in a python library. It takes as input the client id + secret (from ESS or CSS, this is not standardized) and then handles the DPoP authentication. I did not try it out in an app yet, but authenticating with client credentials works so far for CSS and ESS.
Documentation: SolidClientCredentials
Source code: GitHub - Otto-AA/solid-client-credentials-py: Solid authentication with client credentials in python
And here’s an example usage (after doing pip install SolidClientCredentials):
from solid_client_credentials import SolidClientCredentialsAuth, DpopTokenProvider
import requests
client_id = 'your-id'
client_secret = 'your-secret'
# The server that provides your account (where you login)
issuer_url = 'https://login.inrupt.com'
# create a token provider
token_provider = DpopTokenProvider(
issuer_url=issuer_url,
client_id=client_id,
client_secret=client_secret
)
# use the tokens with the requests library
auth = SolidClientCredentialsAuth(token_provider)
res = requests.get('https://example.org/private/stuff', auth=auth)
print(res.text)
Regarding the standardization: Obtaining client credentials is not standardized and it’s different with ESS and CSS. But I think it allows to authenticate as a webId on these servers which also allows users from other Solid servers to interact with such applications. Therefore, the standardization limitation is only about where you host your applications webId (ESS/CSS), not about which users can give access to your applications webId (every standard compliant user). If you have thoughts on this please share them, I still need to understand this better.