Client Credentials Flow

Definition

Imagine you work at a company that has a corporate account with a shipping service. When you need to send a package, you don’t log in with your personal email and password - instead, the company uses its business credentials to access the shipping API. Nobody at FedEx needs to know which employee is sending the package; what matters is that your company is authorized to use the service. That’s the essence of Client Credentials Flow.

Client Credentials Flow is an OAuth 2.0 authentication method designed for situations where there’s no human user involved - just one computer system talking to another. Instead of a person typing in a username and password, a server application presents its own credentials (a client ID and client secret, which are essentially a username and password for machines) to get permission to access an API. It’s machine-to-machine authentication in its purest form.

This flow is perfect for background services, scheduled jobs, microservices communicating with each other, and any scenario where the application itself - not a specific user - needs access to resources. Think of it as giving your application its own identity, separate from any user who might interact with it. The application proves it’s legitimate, receives an access token, and can then make API calls using that token.

Example

Real-World Scenario 1: Payment Processing Backend When Uber needs to charge your credit card after a ride, their payment service talks to Stripe’s API. There’s no user logging in during this process - it happens automatically in the background. Uber’s payment service uses its client credentials to authenticate with Stripe, proving it’s really Uber (not some attacker), and then processes the charge. The transaction happens entirely between servers.

Real-World Scenario 2: Microservices in an E-commerce Platform Amazon’s inventory service needs to constantly check with the pricing service to ensure products are priced correctly. These two services use client credentials to authenticate with each other. The inventory service presents its credentials to the authentication server, gets a token, and uses that token to ask the pricing service for current prices - all without any human involvement.

Real-World Scenario 3: Nightly Data Synchronization A company’s HR system needs to sync employee data with their payroll provider every night at 2 AM. Since no human is awake to type in credentials, the HR system uses its client credentials to authenticate with the payroll API, download updates, and push changes. The whole process runs automatically, securely authenticated as the HR system itself.

Real-World Scenario 4: IoT Device Management A smart thermostat manufacturer has thousands of devices checking for firmware updates. Each device fleet (not individual thermostats, but the management server) uses client credentials to authenticate with the update server. The server proves it’s the legitimate management system and retrieves update information for all devices it manages.

Analogy

The Company Credit Card: Think of client credentials like a company credit card rather than a personal one. When you use a personal credit card, the bank verifies who YOU are. But a company credit card is issued to the business itself - it doesn’t matter which employee uses it; what matters is that the company is responsible for the charges. Client credentials work the same way: the application itself is the “customer,” not any individual user.

The Wholesale Warehouse Membership: Costco requires a membership card to shop. As an individual, you show your personal card with your photo. But businesses have business memberships - the company itself is the member, and any authorized representative can use that membership. Client credentials are the API equivalent: the application is a “business member” of the API service.

The Service Entrance Key: In an apartment building, residents have keys to their individual units. But the maintenance company has a different kind of key - one that lets their service vehicles into the parking garage and their staff into utility areas. This key doesn’t belong to any individual maintenance worker; it belongs to the company itself and grants access for company purposes.

The Press Pass vs. Media Outlet Credentials: A journalist might have a personal press pass to cover events. But major news organizations also have organizational credentials that let them access press areas, regardless of which specific reporter shows up. The organization itself is credentialed, not just the individual.

Diagram

sequenceDiagram
    participant App as Backend Service
    participant Auth as Authorization Server
    participant API as Resource Server

    Note over App,API: Machine-to-machine authentication
(No user involved)

    App->>Auth: 1. POST /token
(client_id + client_secret)
    Note over App,Auth: Direct server-to-server call
Credentials sent securely
    Auth->>Auth: 2. Validate client credentials
    Auth->>App: 3. Access token
(no refresh token needed)

    loop API Calls
        App->>API: 4. Request with Bearer token
        API->>API: 5. Validate token
        API->>App: 6. Protected resource
    end

    Note over App: Token expires → Request new token
No user interaction required

Code Example

// Client Credentials Flow
const getAccessToken = async () => {
  const response = await fetch('https://oauth.provider.com/token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': 'Basic ' + btoa(`${clientId}:${clientSecret}`)
    },
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      scope: 'api:read api:write'
    })
  });

  const { access_token } = await response.json();
  return access_token;
};

// Use token for API calls
const token = await getAccessToken();
const data = await fetch('https://api.example.com/resource', {
  headers: { 'Authorization': `Bearer ${token}` }
});

Security Notes

Standards & RFCs