granttypeclientcredentials

Grant type client credentials, commonly called the client_credentials grant, is an OAuth 2.0 authorization flow designed for machine-to-machine authentication where no end user is involved. It enables a client application to obtain an access token from an authorization server to access protected resources directly, typically in a service-to-service or daemon scenario.

In this flow, the client authenticates to the authorization server using its own credentials (such as a client ID and client secret, or a client assertion issued by a trusted issuer). The client makes a token request to the token endpoint with grant_type set to client_credentials and may include a scope indicating the intended permissions. The authorization server validates the client, and if valid, issues an access token. The response generally includes the access_token, token_type (usually Bearer), expires_in, and, optionally, the scope granted. Unlike flows involving user authorization, there is no authorization code or user consent step.

The access token is then used by the client to authorize requests to resource servers, typically by including it in the Authorization header as a Bearer token. Scopes limit the token’s access to specific APIs or operations. In practice, refresh tokens are often not issued for this flow because the client can obtain a new access token using its own credentials; token lifetimes are managed by the authorization server.

Security considerations emphasize protecting client credentials, using TLS, rotating secrets, and applying the principle of least privilege with limited scopes. Mutual TLS or private key cryptography can enhance security for highly trusted clients. This grant type is suited for trusted server-to-server communications and is not appropriate for obtaining access on behalf of a user.