What Is the OAuth Client Credentials Flow?

The OAuth Client Credentials Flow is the grant type designed for machine-to-machine (M2M) authentication, where no user is involved. The client exchanges its own credentials (client ID and secret) directly for an access token in a four-step process: registration, token request, validation, and token response. It is appropriate when the token represents the application itself — backend services, scheduled jobs, CLI tools, microservices, or AI agents — but not when a specific user's identity or consent is required. Security best practices include short-lived tokens, minimal scopes, audience binding via the `aud` claim, secrets management, and preferring stronger auth methods like `private_key_jwt` over shared secrets. In agentic/MCP contexts, the flow is covered by an MCP authorization extension for non-interactive clients, with JWT Bearer Assertions (RFC 7523) recommended over client secrets. Key considerations for agentic deployments include Dynamic Client Registration for dynamic agent populations, fine-grained per-tool scopes, and policy enforcement at the resource server level since no user context exists in the token.