Machine-to-MachineID: client_credentials

Client Credentials Flow

Direct server-to-server authorization for machine-to-machine (M2M) communications, microservices, daemons, and automated jobs without end-user interaction.

#oauth2#client-credentials#machine-to-machine#m2m#daemon#microservices#api

Présentation

The Client Credentials Flow (RFC 6749 Section 4.4) is used when the client application requests access to resources under its own control, or when interacting with APIs on its own behalf rather than on behalf of a specific end-user.

Unlike browser flows, there is no user login screen, consent prompt, or browser redirect. The client authenticates directly against the authorization server token endpoint using its confidential credentials (such as a client secret, mutual TLS, or private key JWT assertion).

This grant is ideal for backend daemons, cron jobs, microservice-to-microservice APIs, automated integrations, and CLI automation without interactive users.

Quick Specifications

Flow Status: standard
Recommended For: Machine to MachineCLI
Token Auth Methods: Client Secret BasicClient Secret PostMutual TLS
Primary Standard: RFC 6749 Section 4.4

Create Client with this Grant

Diagramme de séquence

Visual sequence illustrating entity interactions and protocol steps

Sequence Diagram

Interactive Diagram

sequenceDiagram
    autonumber
    participant S as Client Service / Daemon
    participant AS as Authorization Server
    participant RS as Resource Server (API)

    S->>AS: POST /oauth/token (grant_type=client_credentials, scope=reports:read, client_id, client_secret)
    AS->>AS: Authenticate client & evaluate allowed scopes
    AS-->>S: 200 OK (access_token, token_type=Bearer, expires_in=3600)
    S->>RS: GET /api/v1/reports (Authorization: Bearer ACCESS_TOKEN)
    RS->>RS: Validate token signature & authorization scopes
    RS-->>S: 200 OK (Protected Data Response)

Déroulement étape par étape

Detailed breakdown of every message exchange, query parameter, and HTTP payload

Prepare Client Credentials Request

Client Service / Daemon→Client Service / Daemon

The background worker or daemon loads its confidential client ID and secret from secure environment variables or a secrets manager.

Request Access Token

Client Service / Daemon→Authorization Server

The client sends a POST request directly to the token endpoint with grant_type=client_credentials and its requested scopes.

Client Credentials Token Request

POST /oauth/token HTTP/1.1
Host: auth.example.com
Authorization: Basic bXlfY2xpZW50X2lkOm15X3NlY3JldF9rZXlfOTg3
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&scope=reports%3Aread%20metrics%3Awrite

Authenticate Client & Issue Access Token

Authorization Server→Client Service / Daemon

The authorization server verifies client credentials, checks that the client is permitted to access the requested scopes, and returns a short-lived access token.

Access Token Response

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "reports:read metrics:write"
}

Authorized API Request

Client Service / Daemon→Resource Server (API)

The service calls downstream microservices or APIs with the access token in the Authorization Bearer header.

API Call with Bearer Token

GET /api/v1/reports HTTP/1.1
Host: api.company.internal
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

API Validates Token and Responds

Resource Server (API)→Client Service / Daemon

The resource server validates the token cryptographic signature and verifies that the token contains the required scopes before serving the request.

API Response

HTTP/1.1 200 OK
Content-Type: application/json

{
  "status": "success",
  "data": [
    {"id": 1, "name": "Monthly Metrics Report"}
  ]
}

Considérations de sécurité

Critical safeguards, threat mitigations, and implementation best practices

No Refresh Tokens Needed

Authorization servers typically do not issue refresh tokens for client credentials. Since the client possesses the static credentials, it simply requests a fresh access token whenever needed.