A client credential is secret or otherwise verifiable information that identifies an OAuth client to an authorization system. In the client credentials grant, a backend service authenticates with its client ID and secret to obtain an access token without user authentication or consent. section 14.3 section 16.3
Configure a client credential for a service-to-service flow by:
- Sending the client ID and secret with HTTP Basic while requesting a token and scope. section 14.3
- Keeping secrets outside implementation code and securely persisting sensitive configuration. section 15.3
- Using separate registrations and preferably distinct scopes when the same application also supports user-dependent grants. section 14.3
Resource server introspection
A resource server becomes an OAuth client when it calls an introspection endpoint. Register it with its own client credential, configure the introspection URI and credentials, then authenticate a protected request with the returned bearer token. section 15.3
Figure 15.6 Token introspection. In situations where the resource server cannot depend on signature-based validation of access tokens (such as when token revocation is necessary), or when the token does not contain detailed information (as with opaque tokens), the resource server is required to make inquiries to the authorization server. This is done to ascertain the validity of a token and to gather additional information about it.
Trace how a resource server presents a bearer token to an authorization server and uses introspection to establish validity and obtain token information. section 15.3
