Tokens and credentials
Client credentials grant
The OAuth 2.0 grant where a service authenticates as itself, with no user involved.
What Client credentials grant means
The client credentials grant is how a service obtains a token on its own behalf. There is no user, no redirect and no consent — the client presents its own credentials and receives an access token representing itself.
Defined in: RFC 6749 §4.4; private key JWT authentication in RFC 7523.
How it works
It is the correct grant for service-to-service calls, scheduled jobs and any workload acting on its own authority. It is the wrong grant for anything acting on behalf of a user: the resulting token carries no user identity, so every action it takes is attributed to the service.
Because there is no user to consent, scopes have to be provisioned rather than requested. The client is configured with what it may ask for, and asking for more fails.
Client authentication itself has options — a shared secret, or a private key with a signed JWT assertion. The second is stronger: nothing secret crosses the wire, so a captured request cannot be replayed to obtain a new token.
The mistake people actually make
Using client credentials for user-initiated work to avoid handling user tokens. Every action then appears in the audit log as the service, and the question 'who deleted this' becomes unanswerable.
Related terms
Machine identity
Credentials issued to a service, workload or agent rather than to a person.
OAuth 2.0
An authorization framework that lets an application obtain limited access to a resource without handling the user's credentials.
DPoP
Demonstrating Proof of Possession — binds a token to a key the client holds, so a stolen token alone is useless.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.