CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What is the OAuth 2.0 'Client Credentials' flow, and when should it be used?
- A.Client Credentials flow is for machine-to-machine (M2M) authentication where no user is involved. The client authenticates directly with the authorization server using its client_id and client_secret, receiving an access token representing the client application's own permissions - not any user's. Used for: background jobs, daemon services, microservice-to-microservice API calls
- B.Client Credentials is used when a user logs in with their email and password directly
- C.Client Credentials is a legacy flow deprecated in favor of Device Code flow
- D.Client Credentials flow is used when a user has forgotten their password and needs to authenticate with alternate credentials
Why A is correct
Client Credentials is one of four main OAuth 2.0 grant types. It bypasses user authorization entirely - the client IS the resource owner. Use cases: scheduled jobs calling internal APIs, microservices authenticating to each other, CI/CD pipelines, system integrations. The client_secret must be kept confidential (server-side only). Security: client credentials should have the minimum scopes needed (principle of least privilege), rotate client secrets regularly, and use short-lived access tokens to limit exposure window.
Know someone studying for Web App Fundamentals? Send them this one.