CodeParkClient Credentials is the flow for machine-to-machine calls, where no user is involved. Example: a billing service calls a reporting API on a schedule.
The client authenticates directly to the token endpoint. It sends grant_type=client_credentials and its own credentials. The credentials can be:
- a client secret
- or, better, a signed JWT assertion
- or mutual TLS (both sides prove who they are with certificates)
The client gets back an access token for the scopes it is allowed.
There is no redirect and no user consent. Normally there is no refresh token either. When the old token expires, the client simply asks for a new one.
The token represents the client itself. So the API decides what to allow based on the client's identity and scopes.
Only confidential clients should use this flow. These are apps that can keep a secret, like a backend server. Never use it in a browser or mobile app.
- It is for machine-to-machine calls with no user.
- The client authenticates directly at the token endpoint.
- There is no redirect, no consent and usually no refresh token.
- The token represents the client, so the API authorizes by the client's scopes.
- Only confidential clients should use it.