That's an interesting use-case. There's no rest endpoints to retrieve access codes, only authorization tokens which you don't really want to send as a URL query parameter. For a SSO solution between your fat client and the web apps the solutions I can think of are: * Use browser to login fat client - we have cli examples that do this * Use Kerberos - this is more complicated and we only plan to add support to authenticate via Kerberos tickets, not to issue tickets ourselves We have discussed the idea of adding an identity token to direct grant api. The idea was that a cli (or fat client) could use the direct grant to obtain an identity token (token for a sso session), which could be stored somewhere on the local file-system. This token could then be used by other apps to retrieve authorization tokens without having to provide user credentials. Maybe this idea could somehow be used by web apps as well, by passing something in the url param. ----- Original Message -----