All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core? What is ASP.NET Core Identity, and what does it provide out of the box? How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles? How does token revocation work with stateless JWTs, given they can't simply be 'deleted' server-side once issued?
Advertisement
Back to results for “OAuth”
.NET › Authentication & Authorization (Identity, JWT, OAuth)

What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow?

Intermediate

Answer

The Client Credentials flow authenticates the application itself (not an end user) using its own client ID and secret to obtain an access token, used for machine-to-machine communication like a backend service calling another API with no human user involved -- unlike Authorization Code flow, which represents delegated user authorization.
POST https://auth.example.com/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=service-a&client_secret=***&scope=api.read
Real-world example A nightly batch job service authenticates to a partner's API using Client Credentials flow since it runs unattended with no user present to authorize anything, obtaining a service-level token scoped to just the permissions the job needs.

Common follow-ups: Why shouldn't client secrets ever be embedded in browser-based or mobile client code?;How does scope limiting reduce the blast radius of a compromised service credential?

Microservices & Distributed Architecture Patterns;Authentication & Authorization (Identity JWT OAuth)
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions