The client credentials grant flow

The client credentials grant is a flow that must be used only by confidential clients, and it enables non-interactive application authentication. This makes sense because embedding the application credentials in a public client (such as a mobile application) exposes them to malicious users, making the whole purpose of keeping such credentials safe and secure in vain.

The flow is described in the following diagram:

Figure 4.5 – Client credentials grant flow

The diagram is explained in detail as follows:

1. The client application requests an access token directly from the /token endpoint of the authorization (AuthZ) server by providing its previously configured credentials (such as client_id and a secret or certificate). This is what a request looks like:

   GET /token?

   grant_type=client_credentials

   &client_id=s6BhdRkqt3

   &scope=resource_server_id

   &client_secret=uayaskiR$£QDcfa

   Host: authzserver.example...