andreareginato/simple-oauth2 — pull request #18 by mikaelbr (2014-07-31 06:02:53+00:00)
Title: Adds support for Bearer headers, fixes indentations and exposes the api method

Hi!

Thanks for this module. After some searching, this looked like the most sensible OAuth2 module out there.

Be warned; I'm no expert in OAuth by any means, but I've been trying to make sense of it a couple of days. It seems to me, when you have the access token you can send this in a Bearer authorisation header as defined here: http://tools.ietf.org/html/rfc6750#section-2.1

With this, it looks like you don't have to send the client id in addition to the token, as the token was created using the client id. I tried setting up a simple API and using `password` grant to get token and do a request with the `access_token` as parameter and it looks to be working as expected.

Again, there might be something I'm missing, but I thought I'd propose this to open a discussion.

Also it looks like from `simple-oauth2.js` require `core.js` without using it, and it seems like maybe the `api` method should be exposed to be able to make requests with OAuth. I couldn't find a way of doing this after getting the access token.

Now you can do something like this:

```javascript
var token = OAuth2.AccessToken.create(resultFromGetToken);

OAuth2.api('GET', '/users', {
access_token: token.token.access_token
}, function (err, data) {
console.log(data);
});
```

---

__As a side note:__ The normal convention in JavaScript is that capitalised variables indicate a constructor Function, and thus one could do something like `var foo = new OAuth2();` or `var foo = new OAuth2.Password();`

Have you considered doing something like:
```javascript
{
'authCode': require('./client/auth-code')(config),
'password': require('./client/password')(config),
'client': require('./client/client')(config),
'accessToken': require('./client/access-token')(config),
'api': require('./core')(config).api
}
```

Thanks again!