Let a service request access for itself.
The client credentials grant lets a service obtain an access token using its own identity. No person needs to sign in for this request.
Why this lesson?
A warehouse job reads orders each night. It uses its own service identity because no person is signed in.
Learning goal and prerequisites
Authenticate the client service
The service sends its client credentials to the token endpoint over Hypertext Transfer Protocol Secure (HTTPS). This example uses Hypertext Transfer Protocol (HTTP) Basic to identify the service. The authorization server checks those credentials and the requested access. There is no browser redirect or user approval step.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Some software needs to call an application programming interface (API) when no person is involved. A scheduled warehouse job, monitoring service, or backend process may need its own access. The client credentials grant exists for that machine-to-machine case.
The service first authenticates itself to the authorization server using an approved client-authentication method. It then asks for an access token for the resource and permissions it needs. If policy allows the request, the authorization server issues a token representing the client itself. The receiving API validates that token before accepting the call.
This flow is useful because the service does not have to send its long-lived client credential to every API. The authorization server can instead issue short-lived tokens with a specific audience and scope. That gives the operator a central place to control which services can obtain which access.
There is no signed-in user in this grant. The token must not be treated as evidence that a person approved the action. Permissions should therefore be limited to the service’s job, and audit records should make clear that the software client—not a human user—performed the request.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.