# kong oauth2 route with GET method **URL:** \ **Category:** Questions\ **Created:** [July 18, 2018, 9:39am UTC](https://discuss.konghq.com/t/kong-oauth2-route-with-get-method/1508 "2018-07-18T09:39:24Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![tejas3190](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tejas3190](https://discuss.konghq.com/u/tejas3190)\ **Post date:** [July 18, 2018, 9:39am UTC](https://discuss.konghq.com/t/kong-oauth2-route-with-get-method/1508/1 "2018-07-18T09:39:24Z")
I have been working on kong APIM recently and facing an issue related routes that are defined with GET method and using OAUTH2 plugin. Routes that are defined with only GET method does not allow for requesting an access token. Maybe I can better explain with an example that I was trying. Steps To Reproduce 1. Service definition: curl -i -X POST --url [http://localhost:8001/services/](http://localhost:8001/services/) --data ‘name=ReadOnlyService’ --data ‘url=http://127.0.0.1:7890’ 2. Route added with only GET method: curl -i -X POST --url [http://localhost:8001/services/ReadOnlyService/routes](http://localhost:8001/services/ReadOnlyService/routes) --data-urlencode ‘paths[]=/test123/cat’ --data ‘methods[]=GET’ --data ‘strip\_path=true’ 3. OAUTH plugin added to “ReadOnlyService” curl -X POST -d “name=oauth2” -d “config.scopes=read” -d “config.mandatory\_scope=true” -d “config.enable\_password\_grant=true” [http://127.0.0.1:8001/services/ReadOnlyService/plugins](http://127.0.0.1:8001/services/ReadOnlyService/plugins) 4. Adding new consumer curl -d “username=RO\_Consumers” [http://127.0.0.1:8001/consumers/](http://127.0.0.1:8001/consumers/) 5. Creating an OAUTH2 application curl -d “name=Foo\_1” -d “redirect\_uri=http://httpbin.org” -d “client\_id=RO\_client” -d “client\_secret=ro\_client” [http://127.0.0.1:8001/consumers/RO\_Consumers/oauth2/](http://127.0.0.1:8001/consumers/RO_Consumers/oauth2/) 6. Requesting access token: curl -d “client\_id=RO\_client” -d “client\_secret=ro\_client” -d “grant\_type=password” -d “scope=read” -d “provision\_key=rZzFaLPtQtxxXOadO7ZR3vGDXsQTagga” -d “authenticated\_userid=ro\_123” [https://127.0.0.1:8443/test123/cat/oauth2/token](https://127.0.0.1:8443/test123/cat/oauth2/token) --insecure Here response received is as =\> {“message”:“no route and no API found with those values”} In the access.log it shows =\> 127.0.0.1 - - [11/Jul/2018:15:54:53 +0530] “POST /test123/cat/oauth2/token HTTP/1.1” 404 69 “-” “curl/7.35.0” Am I missing out something here? Kong version: 0.13 ---
**Author:** ![thomas\_mcavoy](https://avatars.discourse-cdn.com/v4/letter/t/9de053/32.png) [@thomas\_mcavoy](https://discuss.konghq.com/u/thomas_mcavoy)\ **Post date:** [July 18, 2018, 9:47pm UTC](https://discuss.konghq.com/t/kong-oauth2-route-with-get-method/1508/2 "2018-07-18T21:47:06Z")
If you find the answer to this question - I have a huge potential here to use kong and yet i still cant get this working ---
**Author:** ![jeremyjpj0916](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jeremyjpj0916/32/1388_2.png) [@jeremyjpj0916](https://discuss.konghq.com/u/jeremyjpj0916)\ **Post date:** [July 19, 2018, 4:41am UTC](https://discuss.konghq.com/t/kong-oauth2-route-with-get-method/1508/3 "2018-07-19T04:41:43Z")
Interesting, makes sense because Proxy is locked down to GET only but OFC if you enable oauth2 on it you would hope logic could over-ride that default to allow POST get the token specifically on that /oauth2/token path (but it does not apparently in your testing). In the mean time here is a working alternative, setup a separate global token URL and enable global on the oauth2 token generation like I described here: > [@Enable OAuth2 for Multiple Services](https://discuss.konghq.com/t/enable-oauth2-for-multiple-services/1427/3): > > Here is what I do for my gateway and I consider it to be a pretty good practice(I think documentation on Kong for best practices here would be helpful some time as the default behavior I consider to be a bit ehhhh). Step 1. Create an route of /auth with a service pointing to some dummy backend URL(it will never get called). Enable the Oauth2 plugin on this proxy with global\_credentials set to true. You now have a clean endpoint like this to give to ALL clients for generating a Bearer token for … ---
**Author:** ![tejas3190](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tejas3190](https://discuss.konghq.com/u/tejas3190)\ **Post date:** [July 19, 2018, 1:35pm UTC](https://discuss.konghq.com/t/kong-oauth2-route-with-get-method/1508/4 "2018-07-19T13:35:20Z")
Thanks Jeremy. Does the solution you mentioned is an standard way the OAUTH procedure are implemented ? ---
**Author:** ![jeremyjpj0916](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jeremyjpj0916/32/1388_2.png) [@jeremyjpj0916](https://discuss.konghq.com/u/jeremyjpj0916)\ **Post date:** [July 19, 2018, 2:40pm UTC](https://discuss.konghq.com/t/kong-oauth2-route-with-get-method/1508/5 "2018-07-19T14:40:40Z")
In my experience yes, most teams prefer to have a standard stand alone OAuth2 bearer token endpoint to transact against and not a changing ones to call on a per proxy uri basis.