https://github.com/spring-projects/spring-security/blob/master/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/AuthorizationGrantType.java I think that password credentials should be provided as a constant for external use. Also, the refresh token entry is missing from the description. (Line 29)