A credential is authentication material used to prove identity. A client credential identifies an application to an authorization server, while user credentials identify people. section 12.2.3 section 12.3
Applications commonly need passwords, API keys, digital certificates, and other secrets to reach internal or external services. Keeping them in configuration files creates drift, weak auditability, and difficult rotation. section 2.2
A centralized credential service provides a safer operational pattern:
- Maintains one source of truth for every application instance. section 2.2
- Supports updates and notifications without requiring application restarts. section 2.2
- Tracks expiration metadata, simplifies rotation, and provides detailed audit logs. section 2.2
- Can protect secrets with hardware security modules. section 2.2
Service-to-service authentication
Suppose ACME must issue payments through a payment service provider. ACME authenticates directly with a trusted authorization server using its client credentials, receives an access token, and sends that token with requests to the provider. No user participates in this client credentials flow. section 12.2.3
