# Client credentials

Documentation owner: product `access`; documentation version: `3.9.1`.
Source: `content/products/access/3.9.1/key-components/modules/oidc/token-endpoint/client-credentials.md` at commit `eaf7a020437971baeee95e87eaf963636040ac71`.

When requesting an access token use grant\_type: client\_credentials.

HTTP POST is used for the token endpoint.

```
Example: http://127.0.0.1:8080/oidc/tenant1/token-endpoint
```

#### Request parameters

These parameters must be posted as a part of the URL-encoded form values.

| Parameter | Description | Mandatory |
| --- | --- | --- |
| `grant_type` | Supported value is `client_credentials`. | true |
| `scope` | requested scopes (space-separated) | false |
| `resource` | one or more values, each identifying a target API (audience).Multiple = multiple params, not space-separated. | false |

## Using the client\_credentials grantRequest parameters

When using the token endpoint with the client\_credentials grant (M2M), a couple of things need to be in place:

* In the discovery\_meta section on the OIDC module add client\_credentials:

```json5
"grant_types_supported": [ 
    "authorization_code", 
    "refresh_token", 
    "client_credentials"
],
```

* In the Relying Party configuration add:

```json
"client_credentials_pipe_id": "client_credentials_pipe",
```

* Add corresponding "client\_credentials\_pipe":

```json5
// Example pipe for JWT access token with ttl of 60 minutes
// Note! For access tokens, jwt header 'typ' must be 'at+jwt'
{
    "id": "client_credentials_pipe",
    "config": {
        "valves": [
            {
                "name": "CreateJwt",
                "enabled": true,
                "config": {
                    "dest": "access_token",
                    "jwt_ttl": 60,
                    "jwt_headers": {
                        "typ": "at+jwt"
                    },
                    "jwt_claims": {
                        "client_id": "${request.client_id}",
                        "sub": "${request.client_id}",
                        "iss": "https://op.example.com",
                        "aud": ["https://api.example.com/"],
                        "scope": "${request.scope}"
                    },
                    "keystore": {
                        "path": "/fortified_test/config/keystore.p12",
                        "password": "supersecret",
                        "type": "PKCS12"
                    },
                    "keystore_password": "supersecret",
                    "keystore_alias": "jwt"
                }
            },
            {
                "name": "JsonObjectCreate",
                "enabled": true,
                "config": {
                    "src": {
                        "access_token": "${item.access_token}",
                        "token_type": "Bearer",
                        "expires_in": 3600,
                        "scope": "read"
                    },
                    "dest": "client_credentials"
                }
            }
        ]
    }
}
```

```json5
// Example pipe for opaque access token with ttl of 60 minutes
{
    "id": "client_credentials_pipe",
    "config": {
        "valves": [
            {
                "name": "CreateItem",
                "enabled": true,
                "config": {
                    "id": "temp",
                    "properties": {}
                }
            },
            {
                "name": "JsonObjectCreate",
                "enabled": true,
                "config": {
                    "src": {
                        "access_token": "",
                        "token_type": "Bearer",
                        "expires_in": 3600,
                        "scope": "read"
                    },
                    "dest": "client_credentials"
                }
            }
        ]
    }
}
```