Client Credentials Flow

The Client Credentials grant (RFC 6749 §4.4) authenticates the client application itself rather than a user. It's the standard choice for service accounts, backend jobs, and machine-to-machine API calls.

When to use it

Use this flow for trusted, confidential clients acting on their own behalf — cron jobs, backend services, or CI pipelines calling a protected API. 3SO exposes this as a Service Account with a downloadable JSON key, mirroring how Kubernetes service accounts work.

1. Token Request

The client authenticates directly with the token endpoint using its own credentials — there is no user redirect or authorization step.

POST /oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET&
scope=api:read api:write

2. Access Token Response

The authorization server validates the client credentials and scope, then issues an access token directly.

{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "api:read api:write"
}

No Refresh Token

Client credentials tokens represent the application, not a user session

Since there's no user session to keep alive, 3SO does not issue a refresh token for this grant. When the access token expires, the client simply requests a new one with the same client credentials.