---
schema: rendered-html/v1
title: "Implicit | Developer Portal for YouTrack and Hub Documentation"
source_url: https://www.jetbrains.com/help/youtrack/devportal/Implicit.html
generated_at: 2026-06-11T14:41:12.151634+00:00
---

Feedback

Thanks for your feedback!

Was this page helpful?

YesNo

Developer Portal for YouTrack and Hub

- Developer Portal
- Apps
- MCP Tools
- YouTrack Workflows
- YouTrack Import Scripts
- YouTrack Form API
- YouTrack REST API
- Hub REST API
- Hub REST API Guide
- Log in to Hub
- Permanent Token Authorization in Hub
- OAuth 2.0 Authorization in Hub
- [Implicit](Implicit.html)
- [Authorization Code](jetbrains__com__help__youtrack__devportal__authorization-code.md)
- Refresh Token
- Resource Owner Password Credentials
- [Client Credentials](jetbrains__com__help__youtrack__devportal__client-credentials.md)
- Extension Grants
- OAuth 2.0 Errors
- REST API URL and Endpoints
- Hub OpenAPI Specification (OAS)
- Hub API Field Syntax
- Sort Syntax in Hub
- Hub API Query Syntax
- Hub REST API Reference

1. Hub REST API
2. Hub REST API Guide
3. Log in to Hub
4. OAuth 2.0 Authorization in Hub
5. [Implicit](#0)

# Implicit﻿

Last modified: 07 May 2026

## Reference to the Standard﻿

[Implicit Grant Flow Specification](https://tools.ietf.org/html/rfc6749#section-4.2)

## Prerequisites﻿

**Client is public**. Typically a JavaScript code in a browser.

1. `Client service ID` — an id of the service associated with the client in Hub.
2. `Scope` — a space separated list of IDs of the registered in Hub services associated with the resource servers. For example, if the client wants to access issues in YouTrack it should find out the id of YouTrack service in Hub. The client can access more then one resource server with a single access token.
3. `Client redirect URI` — an URI at the client application that can handle response from Hub.
4. `Hub URL` — an URL of the Hub server.
5. `State` — an identifier of current application state. For example, it can be a key for a local storage object that contains information about current user location in the client service.
6. `Request credentials mode`

   — parameter that controls if the login form should be shown to a user. The following values are valid:

   - `skip`

     — use this option, if the client service generally allows anonymous access. It works as following:

     - If a user is already logged in to Hub, then authorize the user to the client service.
     - If a user is not logged in to Hub and the guest account is not banned, then authorize guest to the client service.
     - If a user is not logged in to Hub and the guest account is banned, then navigate the user to login form.
   - `silent` — same as `skip`, but will return back anyway. If the guest account is banned, then this option returns to the client service with an authentication error.
   - `required` — logs out a user and shows login form. Use this option as a response to log out in the client service.
   - `default`

     — use this option if the client service does not allow anonymous access. It works as following:

     - if a user is already logged in to Hub, then authorize the user to the client service,
     - if a user is not logged in to Hub, then navigate the user to the login form.

## Sending User to Authorization Server (Hub)﻿

To start authentication code should redirect browser to:

```
${Hub Service URL}/api/rest/oauth2/auth?response_type=token&state=${State}&redirect_uri=${Client redirect URI}&request_credentials=${Request credentials mode}&client_id=${Client service ID}&scope=${Scope}
```

Example:

```
https://hub.company.com/api/rest/oauth2/auth?response_type=token&state=9b8fdea0-fc3a-410c-9577-5dee1ae028da&redirect_uri=https%3A%2F%2Fmyservice.company.com%2Fauthorized&request_credentials=skip&client_id=98071167-004c-4ddf-ba37-5d4599fdf319&scope=0-0-0-0-0%2098071167-004c-4ddf-ba37-5d4599fdf319
```

## Handling Authorization Server (Hub) Response﻿

Client service should be able to handle responses from Hub at the URL passed as `redirect_uri`. Response parameters are passed after a hash sign in the URL. Thus these parameters are not sent to the server and cannot be intercepted by a malefactor.

If the resource owner grants the access request, Hub issues an access token and delivers it to the client by adding the following parameters to the fragment component of the redirection URI using the `"application/x-www-form-urlencoded"` format:

access\_token
:   The access token issued by the authorization server.

token\_type
:   The type of the token issued by Hub. Value is case insensitive.

expires\_in
:   The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.

scope
:   Optional, if identical to the scope requested by the client; otherwise, required. The scope of the access token in Hub is the service\_id.

state
:   Required if the "state" parameter was present in the client authorization request. The exact value received from the client.

The authorization server (Hub) will not issue a refresh token.

For example, the Hub server redirects the user-agent by sending the following HTTP response:

```
HTTP/1.1 302 Found
Location:
http://myservice.company.com/authorized#access_token=1443459450185.0-0-0-0-0.98071167-004c-4ddf-ba37-5d4599fdf319.0-0-0-0-0%3B1.MCwCFC%2FYWvLjHdzOdpLleDLITJn4Mz9rAhRklCoZ2dlMkh2aCd1K5QQ89ibsxg%3D%3D&token_type=Bearer&expires_in=3600&scope=0-0-0-0-0%2098071167-004c-4ddf-ba37-5d4599fdf319&state=9b8fdea0-fc3a-410c-9577-5dee1ae028da
```

## Handling Error Redirect Back from Hub﻿

If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the Hub server will inform the resource owner of the error and will not automatically redirect the user-agent to the invalid redirection URI.

If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the client by adding the following parameters to the fragment component of the redirection URI using the "`application/x-www-form-urlencoded`" format:

error
:   A single ASCII [USASCII] error code from the following:

    - `invalid_request` - The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.
    - `unauthorized_client` - The client is not authorized to request an authorization code using this method.
    - `access_denied` - The resource owner or Hub denied the request.
    - `unsupported_response_type` Hub does not support obtaining an authorization code using this method.
    - `invalid_scope` The requested scope is invalid, unknown, or malformed.
    - `server_error` The Hub server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed because a 500 Internal Server Error HTTP status code cannot be returned to the client via an HTTP redirect.)
    - `temporarily_unavailable` The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This error code is needed because a 503 Service Unavailable HTTP status code cannot be returned to the client via an HTTP redirect.)

error\_description
:   Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred.

error\_uri
:   A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.

state
:   Required if a "state" parameter was present in the client authorization request. The exact value received from the client.

For example, Hub redirects the user-agent by sending the following HTTP response:

```
HTTP/1.1 302 Found
Location: https://myservice.company.com/cb#error=access_denied&state=xyz
```

- [Implicit](/help/youtrack/devportal/Implicit.html)
- [Reference to the Standard](/help/youtrack/devportal/Implicit.html#StandardReference)
- [Prerequisites](/help/youtrack/devportal/Implicit.html#Prerequisites)
- [Sending User to Authorization Server (Hub)](/help/youtrack/devportal/Implicit.html#SendUserToAuthServer)
- [Handling Authorization Server (Hub) Response](/help/youtrack/devportal/Implicit.html#AuthServerResponse)
- [Handling Error Redirect Back from Hub](/help/youtrack/devportal/Implicit.html#ErrorRedirectBackFromHub)

OAuth 2.0 Authorization in Hub[Authorization Code](jetbrains__com__help__youtrack__devportal__authorization-code.md)

- Privacy & Security
- Terms Of Use
- Trademarks
- Legal

Copyright © 2000–2026 JetBrains s.r.o.

![](https://bat.bing.com/action/0?ti=5220035&tm=gtm002&Ver=2&mid=a7b9dee5-7d6b-4351-bd22-72c9707c7c45&bo=4&sid=452929b065a111f19a7fe7356f74a419&vid=aa3122f0648711f1a10d6d095e10fd87&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=1920&sh=1080&sc=24&tl=Implicit%20%7C%20Developer%20Portal%20for%20YouTrack%20and%20Hub%20Documentation&p=https%3A%2F%2Fwww.jetbrains.com%2Fhelp%2Fyoutrack%2Fdevportal%2FImplicit.html&r=&lt=935&pt=1781188870410,53,53,,,2,2,2,2,2,,2,50,50,55,254,254,254,933,934,935&pn=0,0&evt=pageLoad&sv=2&asc=G&cdb=AQAS&rn=735143)
