A computer-implemented method for obtaining an access token for providing access to a protected resource stored at a resource system, the method comprising: storing (501; 503), at a client system: a plurality of grant method code portions each executable to obtain access to the access token using one of a plurality of types of grant method, wherein each respective type of grant method is different to the other types of grant method; and a plurality of authentication method code portions each executable to authenticate the client system using a different authentication method, wherein each respective type of authentication method is different to the other types of authentication method; storing, at the client system, a configurable database comprising a plurality of authorisation system identifiers each indicative of a respective authorisation system, wherein each of the plurality of authorisation system identifiers is associated with one or more of the plurality of types of grant method which are supported by the respective authorisation system, and each of the plurality of authorisation system identifiers is associated with one or more of the plurality of types of authentication method which are supported by the respective authorisation system; receiving, at the client system, from a user device an access request comprising an instruction for the client system to access a protected resource, the instruction comprising a request identifier indicative of an authorisation system for authorising access to the protected resource; identifying, in the configurable database, a selected grant method type from one or more of the grant method types associated with an authorisation system identifier corresponding to the request identifier; identifying, in the configurable database, a selected authentication method type, from one or more of the authentication method types associated with the authorisation system identifier corresponding to the request identifier; executing, at the client system, the grant method code portion corresponding to the selected grant method type to request the access token for accessing the protected resource; executing, at the client system, the authentication method code portion corresponding to the selected authentication method type to authenticate the client system at the authorisation system; and receiving the access token at the client system from the authorisation system, in response to executing the grant method code portion and the authentication method code portion. storing (501; 503), at a client system: a plurality of grant method code portions each executable to obtain access to the access token using one of a plurality of types of grant method, wherein each respective type of grant method is different to the other types of grant method; and a plurality of authentication method code portions each executable to authenticate the client system using a different authentication method, wherein each respective type of authentication method is different to the other types of authentication method; a plurality of grant method code portions each executable to obtain access to the access token using one of a plurality of types of grant method, wherein each respective type of grant method is different to the other types of grant method; and a plurality of authentication method code portions each executable to authenticate the client system using a different authentication method, wherein each respective type of authentication method is different to the other types of authentication method; storing, at the client system, a configurable database comprising a plurality of authorisation system identifiers each indicative of a respective authorisation system, wherein each of the plurality of authorisation system identifiers is associated with one or more of the plurality of types of grant method which are supported by the respective authorisation system, and each of the plurality of authorisation system identifiers is associated with one or more of the plurality of types of authentication method which are supported by the respective authorisation system; receiving, at the client system, from a user device an access request comprising an instruction for the client system to access a protected resource, the instruction comprising a request identifier indicative of an authorisation system for authorising access to the protected resource; identifying, in the configurable database, a selected grant method type from one or more of the grant method types associated with an authorisation system identifier corresponding to the request identifier; identifying, in the configurable database, a selected authentication method type, from one or more of the authentication method types associated with the authorisation system identifier corresponding to the request identifier; executing, at the client system, the grant method code portion corresponding to the selected grant method type to request the access token for accessing the protected resource; executing, at the client system, the authentication method code portion corresponding to the selected authentication method type to authenticate the client system at the authorisation system; and receiving the access token at the client system from the authorisation system, in response to executing the grant method code portion and the authentication method code portion.