diff --git a/cmd/authz.go b/cmd/authz.go
index 468299b..8ae1617 100644
--- a/cmd/authz.go
+++ b/cmd/authz.go
@@ -29,6 +29,7 @@ This command has no effect by itself, the authorization type needs to be specifi
cmd.AddCommand(
authz.UserCmd(imsConfig),
authz.UserPkceCmd(imsConfig),
+ authz.ImplicitCmd(imsConfig),
authz.ServiceCmd(imsConfig),
authz.JWTCmd(imsConfig),
authz.ClientCredentialsCmd(imsConfig),
diff --git a/cmd/authz/implicit.go b/cmd/authz/implicit.go
new file mode 100644
index 0000000..4737fd0
--- /dev/null
+++ b/cmd/authz/implicit.go
@@ -0,0 +1,51 @@
+// Copyright 2026 Adobe. All rights reserved.
+// This file is licensed to you under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may obtain a copy
+// of the License at http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software distributed under
+// the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+// OF ANY KIND, either express or implied. See the License for the specific language
+// governing permissions and limitations under the License.
+
+package authz
+
+import (
+ "fmt"
+
+ "github.com/adobe/imscli/ims"
+ "github.com/spf13/cobra"
+)
+
+func ImplicitCmd(imsConfig *ims.Config) *cobra.Command {
+
+ cmd := &cobra.Command{
+ Use: "implicit",
+ Short: "Negotiate an access token using the OAuth 2.0 implicit grant flow.",
+ Long: "Perform the 'Implicit Grant Flow' by launching a browser, completing authentication with IMS, " +
+ "and capturing the access token. IMS redirects to a static page (default: " +
+ ims.DefaultImplicitRedirectURI + ") that converts the URL fragment to a query string and " +
+ "forwards it to the local callback server.",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ cmd.SilenceUsage = true
+
+ resp, err := imsConfig.AuthorizeImplicit()
+ if err != nil {
+ return fmt.Errorf("error in implicit authorization: %w", err)
+ }
+ fmt.Println(resp)
+ return nil
+ },
+ }
+
+ cmd.Flags().StringVarP(&imsConfig.ClientID, "clientID", "c", "", "IMS client ID.")
+ cmd.Flags().StringSliceVarP(&imsConfig.Scopes, "scopes", "s", []string{}, "Scopes to request.")
+ cmd.Flags().IntVarP(&imsConfig.Port, "port", "l", 8888, "Local port to be used by the OAuth Client. "+
+ "Must match the port that the redirector page sends the browser to (the default redirector pins 8888).")
+ cmd.Flags().StringVar(&imsConfig.RedirectURI, "redirectURI", ims.DefaultImplicitRedirectURI,
+ "Redirect URI registered with IMS.")
+ cmd.Flags().StringSliceVarP(&imsConfig.Resource, "resource", "r", nil,
+ "Resource indicator URI(s) for audience-restricted tokens.")
+
+ return cmd
+}
diff --git a/docs/redirect/implicit/index.html b/docs/redirect/implicit/index.html
new file mode 100644
index 0000000..3b1f913
--- /dev/null
+++ b/docs/redirect/implicit/index.html
@@ -0,0 +1,17 @@
+
+
+
+
+ imscli implicit-flow redirection to localhost:8888
+
+
+
If your browser is not automatically redirected, copy the URL from your address bar — the access token is in the fragment (after the #).
+
+
+
+
diff --git a/ims/authz_implicit.go b/ims/authz_implicit.go
new file mode 100644
index 0000000..58e48cf
--- /dev/null
+++ b/ims/authz_implicit.go
@@ -0,0 +1,241 @@
+// Copyright 2026 Adobe. All rights reserved.
+// This file is licensed to you under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may obtain a copy
+// of the License at http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software distributed under
+// the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+// OF ANY KIND, either express or implied. See the License for the specific language
+// governing permissions and limitations under the License.
+
+package ims
+
+import (
+ "context"
+ "crypto/rand"
+ "crypto/subtle"
+ "encoding/base64"
+ "fmt"
+ "io"
+ "log"
+ "net"
+ "net/http"
+ "os"
+ "time"
+
+ "github.com/adobe/ims-go/ims"
+)
+
+// DefaultImplicitRedirectURI is the canonical public redirector served from
+// docs/redirect/implicit/index.html. The implicit flow returns the access
+// token in the URL fragment (#access_token=...), which the browser never
+// sends to a server. That static page runs a one-liner that converts the
+// fragment to a query string and navigates the browser to localhost, where
+// our Go handler can finally read the parameters from r.URL.Query().
+//
+// Crafty users running on a non-default port can host their own redirector
+// (pointing at the desired localhost port), register it with IMS for their
+// client, and pass --redirectURI to override this default.
+const DefaultImplicitRedirectURI = "https://opensource.adobe.com/imscli/redirect/implicit/"
+
+// validateAuthorizeImplicitConfig checks that the configuration has valid
+// parameters for the implicit grant flow.
+func (i Config) validateAuthorizeImplicitConfig() error {
+ switch {
+ case i.URL == "":
+ return fmt.Errorf("missing IMS base URL parameter")
+ case !validateURL(i.URL):
+ return fmt.Errorf("unable to parse URL parameter")
+ case len(i.Scopes) == 0 || i.Scopes[0] == "":
+ return fmt.Errorf("missing scopes parameter")
+ case i.ClientID == "":
+ return fmt.Errorf("missing client id parameter")
+ case i.Port <= 0:
+ return fmt.Errorf("missing or invalid port parameter")
+ case i.RedirectURI == "":
+ return fmt.Errorf("missing redirect URI parameter")
+ case !validateURL(i.RedirectURI):
+ return fmt.Errorf("unable to parse redirect URI parameter")
+ }
+ log.Println("all needed parameters verified not empty")
+ return nil
+}
+
+// AuthorizeImplicit performs the OAuth 2.0 implicit grant flow with IMS.
+// IMS redirects the browser to the configured RedirectURI (a public static
+// page) which JS-rewrites the URL fragment into a query string and navigates
+// the browser to the local listener. Returns the access token after state
+// validation.
+func (i Config) AuthorizeImplicit() (string, error) {
+ if err := i.validateAuthorizeImplicitConfig(); err != nil {
+ return "", fmt.Errorf("invalid parameters for implicit authorization: %w", err)
+ }
+
+ c, err := i.newIMSClient()
+ if err != nil {
+ return "", fmt.Errorf("error creating the IMS client: %w", err)
+ }
+
+ state, err := randomState()
+ if err != nil {
+ return "", fmt.Errorf("generate state: %w", err)
+ }
+
+ authURL, err := c.AuthorizeURL(&ims.AuthorizeURLConfig{
+ ClientID: i.ClientID,
+ GrantType: ims.GrantTypeImplicit,
+ Scope: i.Scopes,
+ RedirectURI: i.RedirectURI,
+ State: state,
+ Resource: i.Resource,
+ })
+ if err != nil {
+ return "", fmt.Errorf("build authorize URL: %w", err)
+ }
+
+ srv, err := startCaptureServer(state, i.Port)
+ if err != nil {
+ return "", err
+ }
+ log.Println("Local server successfully launched and contacted.")
+
+ openBrowser(authURL)
+
+ var (
+ serr error
+ resp *TokenInfo
+ )
+
+ select {
+ case serr = <-srv.errCh:
+ log.Println("The implicit callback handler returned an error message.")
+ case resp = <-srv.resCh:
+ log.Println("The implicit callback handler returned a token.")
+ case serr = <-srv.serveCh:
+ log.Println("The local server stopped unexpectedly.")
+ case <-time.After(authTimeout):
+ fmt.Fprintf(os.Stderr, "Timeout reached waiting for the user to finish the authentication ...\n")
+ serr = fmt.Errorf("user timed out")
+ }
+
+ shutdownCtx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+ defer cancel()
+
+ if err := srv.server.Shutdown(shutdownCtx); err != nil {
+ return "", fmt.Errorf("error shutting down the local server: %w", err)
+ }
+ log.Println("Local server shut down ...")
+
+ if serr != nil {
+ return "", fmt.Errorf("error in implicit authorization: %w", serr)
+ }
+
+ return resp.AccessToken, nil
+}
+
+// captureServer is the local HTTP listener that receives the access token
+// from the static redirector page after the JS bridge rewrites the URL
+// fragment into a query string.
+type captureServer struct {
+ server *http.Server
+ resCh <-chan *TokenInfo
+ errCh <-chan error
+ serveCh <-chan error
+}
+
+// startCaptureServer creates and starts the local capture HTTP server in a
+// background goroutine, listening on the given port. The returned channels
+// signal the outcome: resCh on success, errCh on handler-level errors,
+// serveCh if the server itself stops unexpectedly. The caller is responsible
+// for calling Shutdown on the server when done; that also closes the listener
+// via http.Server.Serve's unwind.
+func startCaptureServer(state string, port int) (*captureServer, error) {
+ resCh := make(chan *TokenInfo, 1)
+ errCh := make(chan error, 1)
+
+ handler := &implicitHandler{
+ expectedState: state,
+ resCh: resCh,
+ errCh: errCh,
+ }
+
+ mux := http.NewServeMux()
+ mux.HandleFunc("/", handler.capture)
+
+ server := &http.Server{Handler: mux}
+
+ listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
+ if err != nil {
+ return nil, fmt.Errorf("unable to listen at port %d: %w", port, err)
+ }
+
+ // Capture Serve errors via a buffered channel. See ims/authz_user.go:136-140
+ // for the rationale.
+ serveCh := make(chan error, 1)
+ go func() {
+ serveCh <- server.Serve(listener)
+ }()
+
+ return &captureServer{
+ server: server,
+ resCh: resCh,
+ errCh: errCh,
+ serveCh: serveCh,
+ }, nil
+}
+
+// implicitHandler holds the per-request state for the implicit-flow callback.
+// Extracted to a struct so the route handler can be unit-tested in isolation
+// from net.Listen and the live select loop.
+type implicitHandler struct {
+ expectedState string
+ resCh chan<- *TokenInfo
+ errCh chan<- error
+}
+
+// capture reads the access token (and related params) from the query string
+// that the external redirector page rewrote from the URL fragment. Validates
+// state against the value sent on the original authorize request — protects
+// the local callback from CSRF (any other open browser tab could otherwise
+// navigate here with attacker-supplied parameters).
+func (h *implicitHandler) capture(w http.ResponseWriter, r *http.Request) {
+ q := r.URL.Query()
+
+ got := q.Get("state")
+ if subtle.ConstantTimeCompare([]byte(got), []byte(h.expectedState)) != 1 {
+ h.errCh <- fmt.Errorf("state mismatch")
+ writeCallbackHTML(w, `
Login failed
State mismatch — see terminal.
`)
+ return
+ }
+
+ if e := q.Get("error"); e != "" {
+ h.errCh <- fmt.Errorf("authorization error: %s: %s", e, q.Get("error_description"))
+ writeCallbackHTML(w, `