I am building a symfony7 website with an API, which is designed to be consumed in scripts’ calls.

In the website, there are users, and I enable the API via a role.

What I need is to make API requests, with an User whose permissions are defined in the website, from my scripts/AMQP workers.

Currently I installed thephpleague/oauth2-server-bundle, and enabled the password grant_type, which seems deprecated, and the refresh_token grant_type.

I see there is LexikJWTAuthenticationBundle, which comes without refresh_token, and needs JWTRefreshTokenBundle to add refresh_token support. I wonder if it is really worth installing it since thephpleague/oauth2-server-bundle has password and refresh_token grants which already does the job.

I read lot of articles telling to use authorization instead of password grant, but in my case the user is not a final user with access to a GUI, but a script or an AMQP worker on a server, so I won’t be able to login manually.

What would you recommend in this case ?

Is there a way to login to Oauth 2.1 APIs when we are calling APIs from scripts ? (without using deprecated password grant).

Currently, I use login/password to authenticate the script user, but in some websites I see there are “application codes” which are unique passwords to use for API only.
I don’t see any grant_type making this possible in Oauth2.1, have you an idea how it could be implemented ?