> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/modules/oidc/token-endpoint/client-credentials.md).

# Client credentials

Used for machine-2-machine

When requesting an access token use grant\_type: client\_credentials.

HTTP POST is used for the token endpoint.

```
Example: http://127.0.0.1:8080/oidc/tenant1/token-endpoint
```

#### Request parameters

These parameters must be posted as a part of the URL-encoded form values.

<table data-full-width="true"><thead><tr><th>Parameter</th><th>Description</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>grant_type</code></td><td>Supported value is <code>client_credentials</code>.</td><td>true</td></tr><tr><td><code>scope</code></td><td>requested scopes (space-separated)</td><td>false</td></tr><tr><td><code>resource</code></td><td><p>one or more values, each identifying a target API (audience).</p><p>Multiple = multiple params, not space-separated.</p></td><td>false</td></tr></tbody></table>

## Using the client\_credentials grantRequest parameters

When using the token endpoint with the client\_credentials grant (M2M), a couple of things need to be in place:

* In the discovery\_meta section on the OIDC module add client\_credentials:

```json5
"grant_types_supported": [ 
    "authorization_code", 
    "refresh_token", 
    "client_credentials"
],
```

* In the Relying Party configuration add:

```json
"client_credentials_pipe_id": "client_credentials_pipe",
```

* Add corresponding "client\_credentials\_pipe":

```json5
// Example pipe for JWT access token with ttl of 60 minutes
// Note! For access tokens, jwt header 'typ' must be 'at+jwt'
{
    "id": "client_credentials_pipe",
    "config": {
        "valves": [
            {
                "name": "CreateJwt",
                "enabled": true,
                "config": {
                    "dest": "access_token",
                    "jwt_ttl": 60,
                    "jwt_headers": {
                        "typ": "at+jwt"
                    },
                    "jwt_claims": {
                        "client_id": "${request.client_id}",
                        "sub": "${request.client_id}",
                        "iss": "https://op.example.com",
                        "aud": ["https://api.example.com/"],
                        "scope": "${request.scope}"
                    },
                    "keystore": {
                        "path": "/fortified_test/config/keystore.p12",
                        "password": "supersecret",
                        "type": "PKCS12"
                    },
                    "keystore_password": "supersecret",
                    "keystore_alias": "jwt"
                }
            },
            {
                "name": "JsonObjectCreate",
                "enabled": true,
                "config": {
                    "src": {
                        "access_token": "${item.access_token}",
                        "token_type": "Bearer",
                        "expires_in": 3600,
                        "scope": "read"
                    },
                    "dest": "client_credentials"
                }
            }
        ]
    }
}
```

```json5
// Example pipe for opaque access token with ttl of 60 minutes
{
    "id": "client_credentials_pipe",
    "config": {
        "valves": [
            {
                "name": "CreateItem",
                "enabled": true,
                "config": {
                    "id": "temp",
                    "properties": {}
                }
            },
            {
                "name": "JsonObjectCreate",
                "enabled": true,
                "config": {
                    "src": {
                        "access_token": "",
                        "token_type": "Bearer",
                        "expires_in": 3600,
                        "scope": "read"
                    },
                    "dest": "client_credentials"
                }
            }
        ]
    }
}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/modules/oidc/token-endpoint/client-credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.