Consider the following OpenAPI OAuth2 security scheme definition:
components:
securitySchemes:
oauth2_auth_code:
type: oauth2
description: Authorize with OAuth2
flows:
authorizationCode:
authorizationUrl: https://login.microsoftonline.com/1d063515-6cad-4195-9486-ea65df456faa/oauth2/v2.0/authorize
tokenUrl: https://login.microsoftonline.com/1d063515-6cad-4195-9486-ea65df456faa/oauth2/v2.0/token
refreshUrl: https://login.microsoftonline.com/1d063515-6cad-4195-9486-ea65df456faa/oauth2/v2.0/token
scopes:
api://779d25c3-6c74-4875-b5ae-ef9b5a04b1e8/user_impersonation: Access Application
This results in Swagger UI displaying available authorizations as:
I don't want users to specify the client_id (it should be provided by developers). Furthermore, client_secret is not relevant here, and should not be displayed.
How can I configure the client_id, client_secret, and redirect URI in the OpenAPI spec, so Swagger UI will not prompt users to enter it themselves?
Reference:
https://swagger.io/docs/specification/authentication/oauth2/