Clarification in documentation for DRF and verifying access_token

So in my app, and how I understand this should work in a microservice application, the flow is the following:

1. User navigates to https://www.example.com/ which is a ReactJS FE.
2. Using react-aad, they are automatically redirected to login using their Azure AD credentials for our tenant ID.
3. This gives them the id_token and access_token.
4. I need to send this access_token to our Django/DRF API where it needs to be verified as being authentic and thus granting client/API communication.

This is my understanding of how social authentication for microservices should work: client gets access_token, sends to API, API verifies it is authentic. This is where your library comes in and your documentation seems to verify this flow.

What I’m confused by, is in the DRF Integration section regarding the access token, the example is showing user and password. Again, it is my understanding user and password are not being sent from the ReactjS FE client, just the access_token and the API is supposed to verify it. This example seems to contradict that.

Can you clarify?

[mihnsen]

@marlonpatrick I set it wrong while trying to integrate it with just one application (Web only). Finally found issue and get over it. Thanks

[JonasKs]

Closing in favor of #81 . Explanation is as previously mentioned in #114, and a PR has been raised (#123) to fix documentation.