OAuth2 client_credentials authentication does not seem to be RFC6749 compliant about tyk

[mhuaco]

@lolleko Thank you for bringing this to our attention. How are you generating the client_id and secret. Could you please share the doc you're referencing? I ask because when I create an OAuth client via our Tyk dashboard, I'm not seeing the special character '$@' included in the client ID and secret.

Regards
Marvin

[lolleko]

Hey Marvin,

Thanks for getting back to me.
We are generating our ID and secret ourselves, we are not using the dashboard.
I manually created ID and secret, including special characters '$@' to showcase this issue.
Like I said, tyk OAuth works as expected as long as we do not include these special characters in our generated IDs/Secrets.

This issue occurs not only for '$@', but for all characters that need to be urlenencoded (https://docs.microfocus.com/OMi/10.62/Content/OMi/ExtGuide/ExtApps/URL_encoding.htm)
Also, it doesn't matter where you put them (I just put them in the beginning and end as a simple example)

So something like s6#Bhd?Rkqt3 or sdaskdop@mlkj$li will also cause issues.

[lolleko]

Ahhh and regarding the referenced docs, I think I put all the relevant references in the Issue description, which one are you missing?