title: Choosing the right OAuth2 grant type for PHP web app
body: <p>I'm building a very typical web app product. It will likely have corresponding mobile apps in the future. I'm building it from the ground up with a REST API, which is secured using OAuth2. I've got OAuth2 working, and I'm able to connect successfully using various grant types.</p>
  
  <p>What I'm a little confused about is what grant types to use for the actual web app. Here's what I had in mind:</p>
  
  <h2>Public API access</h2>
  
  <p>Before a user logs into the web app, some API access is required for things like user registration and password resets. I was thinking of using the <code>client_credientials</code> grant type. A simple client id and secret validation in return for an access token.</p>
  
  <p>However, it seems totally unnecessary to request an access to token for every single public request or even for each session. It seems to make more sense to just generate ONE access token that my web app will always use.</p>
  
  <p>Yet, this seems to go against how OAuth is designed to work. For example, access tokens expire. What is the right way of doing this?</p>
  
  <h2>Private user API access</h2>
  
  <p>Next, for a user to login to the web app I was planning on using the <code>password</code> grant type (resource owner password credentials). This approach allows me to save the <code>user_id</code> with the access token—so I know which user is logged in. Further, by using scopes I can restrict access within the API.</p>
  
  <p>I plan to save the access token within the PHP session. As long as the PHP session is active they will remain logged into the web app.</p>
  
  <p>Is this an appropriate design for user login?</p>