Client credentials grant type

As explained in Authorization in Action

A client credentials grant is an OAuth grant type in which a client authenticates with its own credentials to obtain an access token without representing an end user.

The client credentials grant type obtains an OAuth access token for an application itself rather than for a signed-in person. It suits headless, tenant-approved integrations that must keep operating continuously, such as a task system synchronizing work with a collaboration platform around the clock. The resulting token represents an integration principal, so an administrator’s setup and installation record can bind that principal to a tenant and selected workspaces. section 11.2.3 section 11.2.4

Use this grant when automation needs service-to-service access but cannot depend on a user session. It differs from the Authorization Code Grant: that flow represents delegated access approved by a user, while client credentials represents an application approved during tenant setup. Both deliver a token to the API boundary; neither token alone determines every permitted operation. section 11.2.3 section 11.2.4

Figure 11.7 CustCo’s Task App authenticates to ACME’s authorization server using its client credentials and receives an access token that represents the app (an integration principal). Admin setup and the installation record bind the app to CustCo and specific workspaces.

The flow shows the app authenticating with its own client credentials and receiving a token for an integration principal. Tenant administration and the installation record constrain where that principal may operate. section 11.2.3

At the API boundary, the token enters a policy-controlled request flow:

• The client sends the access token in the HTTP Authorization header. section 11.2.4
• The gateway validates its signature, issuer, audience, expiration, and scopes, and identifies the application integration principal. section 11.2.4
• The gateway derives a Cedar PARC request: principal from the token, action from the API method, resource from the request, and context such as scopes, tenant, or user attribution. section 11.2.4
• Cedar evaluates policy, and the gateway allows the API call or blocks it with a 403 response. section 11.2.4

Tenant-scoped Task App

A customer’s Task App can create and update tasks from collaboration workspaces without requiring Jack to remain signed in. Its token identifies custco-tasks, carries task-write and document-metadata scopes, and is evaluated with tenant and allowed-workspace attributes. Policy can limit the app to CustCo-owned installed workspaces and require a CustCo user attribution on writes, preserving audit and control context. section 11.2.3 section 11.2.4

The grant supplies authenticated application identity and API scopes; Cedar supplies fine-grained authorization over the requested action, resource, and context. Place validation and enforcement at a clear request-path control point—such as a gateway, service mesh, or per-service proxy—and log the decision. section 11.2.4 section 11.4

How Authorization in Action covers it

How deep it goes

Explains token acquisition by role and traces validation, PARC construction, and Cedar enforcement without detailing client authentication mechanics.

Examples

Uses CustCo’s Task App to synchronize collaboration tasks under tenant, workspace, scope, and user-attribution constraints.

What it assumes

Assumes familiarity with APIs and access tokens while defining the application-versus-user identity distinction.

What you can do after

Operate/configure it as a tenant-bound integration whose token is validated and constrained by Cedar policy.

How it connects

Connects OAuth access tokens with Authorization Code Grant, API gateways, Cedar, scopes, PARC requests, and integration principals.

liveBookmanning.com

Read Authorization in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Spring Security in Action, Second EditionThe client credentials grant type is an OAuth 2 grant in which a client obtains an access token using its own credentials without user involvement.
• 

  liveBookmanning.com
  Software Security for DevelopersThe client credentials flow is an OAuth flow in which a client authenticates with its own credentials to obtain an access token without an end-user authorization step.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eThe client credentials grant is an OAuth 2.0 flow in which an application authenticates as itself to obtain authorization for machine-to-machine access.
• 

  liveBookmanning.com
  Secure APIsThe client credentials flow is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user interaction.

Compare how 5 books explain client credentials grant type →

Related concepts

• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• authorization code flowcontrasts with · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• grant typekind of · A grant type is an OAuth-defined authorization flow or token-request parameter specifying how a client obtains an access token.
• OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.