OAuth 2.0 Client Credentials Flow
Machine-to-machine flow where a confidential client authenticates directly with the authorization server using its own credentials and receives an access token to call a protected API, with no user involved.
The client credentials grant is used when an application acts on its own behalf rather than on behalf of a user, for example a backend service, a scheduled job or a daemon calling an API. There is no user, no browser and no redirect: the confidential client authenticates directly with the authorization server and exchanges its credentials for an access token.
Because the client must keep its secret confidential, this flow must only be used by clients that can do so (never by browser-based or mobile apps). Refresh tokens are not issued in this flow; the client simply requests a new access token when the current one expires.