When is the client credentials flow used, and how does it work?
For machine-to-machine (M2M) access, such as daemons or backend services, where no user is involved: a trusted client authenticates with its own credentials at the authorization server and receives an access token directly.
The flow has just two messages:
- Request access token: the client sends its client credentials (client ID and secret, or another form of client authentication such as a signed JWT or a TLS client certificate) to the token endpoint with
grant_type=client_credentials. - Response with access token: the authorization server returns an access token.
It is used when the client is the resource owner itself (a service accessing its own data) or when the client was authorised beforehand, for example by an administrator granting a reporting service access to an API.
Two things follow from the absence of a user. It is only for trusted (confidential) clients, because the client's credentials are the only thing standing between an attacker and the token. And it typically issues no refresh token: the client can simply request a new access token with its credentials whenever the old one expires.
Go deeper:
RFC 6749, Section 4.4: Client Credentials Grant — the request and response, and why no refresh token is included.- oauth.net: Client Credentials Grant — when to use it, in a few lines.