OAuth client credentials grant
The OAuth client credentials grant lets a confidential client obtain an access token using its own authentication credentials for access already authorized to that client, without an interactive user sign-in.
Software authenticates as itself
A background service can need API access while no person is signed in. In this grant, the client authenticates to the authorization server and requests an access token. The receiving API still decides whether the token permits the requested operation.
RFC 6749 limits this grant to confidential clients: clients capable of keeping their credentials confidential. It is not a way to put a shared secret into a public web page or a widely distributed app and call that secret protected.
Client authentication need not use a shared secret. Microsoft’s identity platform also supports certificates and federated credentials. Its implementation does not issue refresh tokens in this flow; the client can authenticate again for another access token.
A new credential can reach existing permissions
Our app credential article follows the risk in adding a credential to an application that already has authority. The new credential does not itself create new resource permissions, but an unauthorized holder may be able to use permissions already granted.
This differs from a delegated flow where an app acts with a signed-in user’s authority. Human MFA settings alone do not describe the protection of this application access path.
The integration-token guide explains why responders need to identify the credential, application, resource permissions, and observed operations separately.