Client credentials

A confidential client gets a token for itself, with no user involved.

POST /oauth/token

Confidential clients only. Returns a token for the client itself: no user, no tenant, no refresh token.

Authorization

The client’s secret, as client_secret_basic or client_secret_post. See Client authentication. A public client cannot use this grant.

Form-encoded (application/x-www-form-urlencoded).

Field	Type	Required	Description
`grant_type`	string	Yes	`client_credentials`
`client_id`	string	No	Required with `client_secret_post`; taken from the `Authorization` header with `client_secret_basic`.
`client_secret`	string	No	Required with `client_secret_post`.

200, with Cache-Control: no-store. No refresh_token.

{
  "token_type": "Bearer",
  "access_token": "eyJ…",
  "expires_in": 3600
}

Every refusal is 400 with an RFC 6749 code and nothing else.

Status	`error`	When
`400`	`invalid_request`	`client_id` is missing or malformed, or differs between header and body.
`400`	`invalid_client`	Unknown client, a public client, a wrong secret, or a disallowed IP.
`400`	`invalid_request`	The host is not an org.
`400`	`unsupported_grant_type`	`grant_type` is not one of the five the endpoint accepts.

curl -X POST https://acme.loginwith.dev/oauth/token \
  -u cli_…:secret \
  -d grant_type=client_credentials