Client credentials grant

Endpoints

/oauth2/access_token

The client credentials grant is intended for clients who are also resource owners that need to access their own data rather than acting on behalf of a user.

For example, an application that needs access to a protected resource to update its configuration might use the client credentials grant to get an access token.

The client credentials grant flow supports confidential clients only.

The client credentials grant flow

Figure 1. OAuth 2.0 client credentials grant flow

The client sends its credentials to the authorization server to get authenticated and requests an access token.
If the client credentials are valid, the authorization server returns an access token to the client.
The client requests access to the protected resource from the resource server.
The resource server contacts the authorization server to validate the access token.
The authorization server validates the token and responds to the resource server.
If the token is valid, the resource server allows the client to access the protected resource.

Demonstrate the client credentials grant flow

Perform these steps to get an access token:

Prepare the demonstration
Get an access token using the client credentials grant

Prepare the demonstration

Complete these steps to prepare the client credentials grant flow demonstration:

Create an application owner profile and record the username and password.
Register a client application.
1. In the Advanced Identity Cloud admin UI, go to Applications and select + Custom Application.
2. Select the sign-in method as OIDC - OpenId Connect and application type as Web.
3. Create the application, providing the following details:
  
  Name
  
  myClient
  
  Owners
  
  <application-owner>
  
  Client ID
  
  myClient
  
  Client Secret
  
  forgerock
4. Switch to the Sign On tab and under General Settings, update these fields to have the following values:
  
  Sign-in URLs
  
  https://www.example.com:443/callback
  
  Scopes
  
  write
5. Ensure Grant Types contains Client Credentials.
6. Save your changes.
Create a resource owner profile and record the username and password.
Under Native Consoles > Access Management, go to Realms > Realm Name > Services > OAuth2 Provider > Advanced and ensure the Grant Types field includes Client Credentials.

Get an access token using the client credentials grant

As the client, call /oauth2/access_token specifying the client’s credentials, and grant_type=client_credentials.

For example:

$ curl
--request POST \
--user '<client-id>:<client-secret>' \
--data "grant_type=client_credentials" \
--data "scope=write" \
"https://<tenant-env-fqdn>/am/oauth2/realms/root/realms/alpha/access_token"

The scope parameter is optional if default values are configured in the authorization server or the client.

PingOne Advanced Identity Cloud returns an access token, for example:

{
  "access_token": "<access-token>",
  "scope": "write",
  "token_type": "Bearer",
  "expires_in": 3599
}