What is the OAuth 2.0 'Client Credentials' flow, and when should it be used?

Question

Accepted Answer

Client Credentials flow is for machine-to-machine (M2M) authentication where no user is involved. The client authenticates directly with the authorization server using its client_id and client_secret, receiving an access token representing the client application's own permissions - not any user's. Used for: background jobs, daemon services, microservice-to-microservice API calls

Answer

Client Credentials is a legacy flow deprecated in favor of Device Code flow

Answer

Client Credentials flow is used when a user has forgotten their password and needs to authenticate with alternate credentials; salts must be kept secret in a separate vault, since a visible salt lets rainbow tables be rebuilt in real time; bearer tokens are safe in URLs because RFC 6750 requires proxies to redact the access_token query parameter from logs; TOTP codes are pushed from the server to the authenticator app over TLS, and a network outage disables the second factor

Answer

Client Credentials is used when a user logs in with their email and password directly; OAuth refresh happens transparently inside the browser's network stack, and application code never sees the refresh token; the client_credentials grant identifies an end user through the client secret, making it suitable for browser apps; OAuth scopes encrypt the sections of the API response the client is entitled to see

What is the OAuth 2.0 'Client Credentials' flow, and when should it be used?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What is the OAuth 2.0 'Client Credentials' flow, and when should it be used?

Where this fits in the Web App Fundamentals exam

More free Authentication Basics questions

One question down. Thousands to go.