clientcredentials

In OAuth 2.0, client credentials refer to the credentials used by a confidential client to authenticate to the authorization server. These typically consist of a client identifier (client_id) and a client secret (client_secret). The term is also used to describe the client's ability to prove its identity when requesting access tokens.

During the Client Credentials grant, the client requests an access token directly from the token endpoint without any user involvement. The client authenticates using its credentials (or other supported methods) and sends grant_type=client_credentials, possibly with a scope. If valid, the authorization server issues an access token. The grant is designed for server-to-server or machine-to-machine communication.

Use cases include automated services, service accounts, and applications acting on their own behalf rather than on behalf of a specific user. The grant is not appropriate when a particular user’s authorization is required. Many implementations do not issue refresh tokens for this grant; tokens must be renewed by requesting a new access token.

Security considerations emphasize protecting the client secret and storing it securely, rotating credentials, and restricting access. When supported, stronger client authentication methods such as private_key_jwt or mutual TLS are preferred over basic client_secret authentication, especially for highly sensitive access. Communications should occur over TLS, and scopes should be minimized to the necessary permissions.

Implementation notes: a typical request uses an HTTP POST to the token endpoint with an Authorization header containing Basic base64(client_id:client_secret). The response includes an access_token, token_type, and expires_in, and may include scope. Some servers support alternative authentication methods, such as JWT-based client authentication.