What is the OAuth 2.0 'Client Credentials' flow, and when should it be used?

• A.The Client Credentials flow suits browser-based apps where the user signs in with a password. The client sends the user's credentials to the token endpoint (a direct grant), receiving an access token with the user's permissions - suited to: single page apps, mobile logins and kiosk screens
• B.The Client Credentials flow issues a refresh token to the user after a device login (a flow with no client secret), enabling long-lived sessions on shared devices. It is used for: kiosks, smart TVs, and CLI tools that read a code from the screen of the device
• C.Client Credentials is the flow where the resource server calls the authorization server with its own password (an internal check), receiving a signed assertion about the user. It is used for: login pages, session refresh, and logout redirects of the user session
• D.Client Credentials flow is for machine-to-machine (M2M) authentication where no user is involved. The client authenticates directly with the authorization server using its client_id and client_secret, receiving an access token representing the client application's own permissions - not any user's. Used for: background jobs, daemon services, microservice-to-microservice API calls