Client credentials grant type

As explained in Secure APIs

The client credentials flow is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user interaction.

The client credentials grant is an OAuth flow for machine-to-machine communication. A nonhuman client directly exchanges its own credentials with an authorization server for an access token, without a browser or repeated user consent. section 7.4.3

Use this flow when the API consumer is a service rather than a person:

• Run automated API calls, such as requests made during continuous integration. section 7.4.3
• Connect services to third-party APIs for email delivery, geolocation, or payment processing. section 7.4.3
• Authenticate internal services communicating across a distributed architecture, such as microservices. section 7.4.3

Scheduled publishing service

A server-side application registered to publish posts on a schedule receives authorization when it is registered. It can then obtain tokens directly whenever it needs to call the API, rather than opening a browser and requesting consent each time. section 7.4.3

Figure 7.8 In the client credentials flow, a server-side application directly exchanges credentials for an access token. If necessary, the resource owner gives consent upon registering the client with the authorization server.

Trace the direct exchange from a server-side application’s credentials to an access token, including registration-time consent when needed. section 7.4.3

How Secure APIs covers it

How deep it goes

Explains the actors, direct token exchange, browser absence, and registration-time consent without detailing credential formats or implementation code.

Examples

Uses continuous integration, email, geolocation, payment processing, microservices, and scheduled social-media publishing.

What it assumes

Assumes familiarity with APIs and authorization while explaining the machine-to-machine constraint from first principles.

What you can do after

Apply it to select a browserless OAuth flow for automated jobs, service integrations, and internal service calls.

How it connects

Connects OAuth, authorization code flow, access tokens, authorization servers, consent, and microservices.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Spring Security in Action, Second EditionThe client credentials grant type is an OAuth 2 grant in which a client obtains an access token using its own credentials without user involvement.
• 

  liveBookmanning.com
  Authorization in ActionA client credentials grant is an OAuth grant type in which a client authenticates with its own credentials to obtain an access token without representing an end user.
• 

  liveBookmanning.com
  Software Security for DevelopersThe client credentials flow is an OAuth flow in which a client authenticates with its own credentials to obtain an access token without an end-user authorization step.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eThe client credentials grant is an OAuth 2.0 flow in which an application authenticates as itself to obtain authorization for machine-to-machine access.

Compare how 5 books explain client credentials grant type →

Related concepts

• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• authorization code flowcontrasts with · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• grant typekind of · A grant type is an OAuth-defined authorization flow or token-request parameter specifying how a client obtains an access token.
• OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.