oauth.net
Client Credentials
The Client Credentials grant is used for machine-to-machine communication where no user is involved. The client authenticates directly with the authorization server using its own credentials and receives an access token.
When to use this
Use Client Credentials when your backend service needs to call another API on its own behalf — not on behalf of a specific user. Common examples: a cron job that syncs data, a microservice calling another internal service, or a server-side process accessing a shared resource.
The request is straightforward: the client sends its client_id and client_secret (or another form of client authentication) to the token endpoint with grant_type=client_credentials. There is no redirect, no user login, and no refresh token — just a direct exchange of credentials for an access token.
Because access tokens are short-lived, clients should request a new one when the current one expires rather than storing it permanently. Many client libraries handle this automatically.
More resources
- Client Credentials (oauth.com)
- Application Access (aaronparecki.com)
- Secure a Node API with OAuth 2.0 Client Credentials (developer.okta.com)