Client Credentials Grant

The Client Credentials Grant is an OAuth 2.0 flow designed for machine-to-machine (M2M) communication where no user is involved. The client (a backend service, daemon, or CLI tool) authenticates directly with the authorization server using its own credentials (client_id and client_secret) and receives an access token. There is no user interaction, no browser redirect, and no refresh token -- the client simply requests a new token when the current one expires.

This grant type is appropriate for service-to-service calls in a microservices architecture, batch processing jobs, backend integrations with third-party APIs, and automated infrastructure operations. The client authenticates by sending a POST request to the token endpoint with grant_type=client_credentials, along with client authentication (typically HTTP Basic auth with client_id:client_secret, or client_id and client_secret in the POST body). The authorization server validates the credentials and returns an access token with the requested scopes.

Security considerations include protecting the client secret with the same rigor as a private key -- store it in environment variables or a secrets manager (not source code), rotate it periodically, and limit each client's scopes to the minimum necessary for its function. Use short-lived tokens (5-15 minutes) and implement token caching on the client side to avoid requesting a new token for every API call. In Kubernetes environments, consider using projected service account tokens or workload identity instead of static client secrets. The client credentials grant should never be used from client-side applications (browsers, mobile apps) where the client secret cannot be kept confidential.