Client Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine access.
This is the flow behind most service-to-service traffic, and the place where long-lived secrets accumulate. The credential authenticates the application itself, so there is no user to revoke and no session to expire, which makes ownership and rotation the whole ballgame. Prefer workload identity federation where the platform can attest the caller, so no secret exists to leak in the first place.
See also: OAuth 2.0, service account, workload identity, what is non-human identity
Related on Start with Identity
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- BlogSAP Cloud SDK for Python flaw sends OAuth client secrets to attackers
CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the clie
- CVESAP Cloud SDK for Python sends OAuth2 client secrets to an attacker-chosen host
CVE-2026-89111 lets anyone who controls the tenant subdomain in a multi-tenant SAP BTP application redirect the SDK's OAuth2 token request, along with the app's
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s