Mastering OAuth 2.0

Overview of the client credentials grant

Figure 6 from RFC 6749

The steps are as follows:

• A: The client authenticates with the service provider and requests an access token from the service provider's token endpoint.
• B: The service provider authenticates the client, and if valid, issues an access token.

Authorization request and response

Since the client is requesting on their own behalf, no further authorization is needed.

Access token request

The client makes a POST request to the service provider's token endpoint passing in the following parameters encoded using the application/x-www-form-urlencoded format, as described in Appendix B of the specification: ...