Client credentials grant

The client credentials grant is the OAuth 2.0 flow with no user in it. A backend service authenticates to the authorization server as itself, with a client ID and secret, and receives an access token representing the service's own permissions. It is the standard way for machines to call APIs on their own behalf.

How it works

The client POSTs grant_type=client_credentials, its credentials and optionally the scopes it wants to the token endpoint. The response contains an access token and its lifetime in expires_in. The client caches the token, uses it in an Authorization: Bearer header until shortly before it expires, then requests a new one — there is no refresh token in this flow.

The misconception

That it is safe in a browser or mobile app. The flow relies on the client keeping its secret, and anything shipped to a user's device cannot. Public clients use the authorization code flow with PKCE instead.

Try it here

POST /auth/v1/oauth/token with grantType client_credentials, clientId demo-client and clientSecret demo-secret returns a token that expires after 15 seconds. Use it on GET /auth/v1/oauth/protected-resource, capturing it with a variable to chain the two requests.

Sources

Other terms

OAuth 2.0 — The standard framework for letting an application get a limited access token, instead of handling the user's password.
Bearer token — A credential where possession alone grants access — whoever holds it can use it.
JWT (JSON Web Token) — A compact format for claims, represented as a signed JWS or encrypted JWE.
JWKS — A JSON Web Key Set — the public keys an issuer publishes so that anyone can verify the tokens it signs.
Refresh token — A long-lived credential used only to obtain new short-lived access tokens, without asking the user to log in again.
PKCE — Proof Key for Code Exchange — a one-time secret that stops a stolen OAuth authorization code from being redeemed by anyone else.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 16 October 2026