Client credentials flow in Rest API - Step-by-Step Execution

Concept Flow - Client credentials flow

Client prepares credentials

↓

Client sends POST request to Auth Server

↓

Auth Server validates credentials

The client sends its credentials to the authorization server, which validates them and returns an access token if valid. The client then uses this token to access protected APIs.

Execution Sample

Rest API

POST /token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=abc&client_secret=xyz

Client sends a POST request with client credentials to get an access token.

Execution Table

Step	Action	Request Data	Server Validation	Response
1	Client prepares POST request	grant_type=client_credentials&client_id=abc&client_secret=xyz	N/A	N/A
2	Client sends POST request to Auth Server	Same as above	Server checks client_id and client_secret	N/A
3	Auth Server validates credentials	N/A	Credentials valid?	Yes
4	Auth Server issues access token	N/A	N/A	{"access_token":"token123","token_type":"Bearer","expires_in":3600}
5	Client receives access token	N/A	N/A	Token stored for API calls
6	Client uses token to access API	Authorization: Bearer token123	Server checks token validity	API response data
7	End	N/A	N/A	Process complete

💡 Process ends after client receives token and uses it to access API.

Variable Tracker

Variable	Start	After Step 1	After Step 4	After Step 5	Final
client_id	None	abc	abc	abc	abc
client_secret	None	xyz	xyz	xyz	xyz
access_token	None	None	token123	token123	token123
token_type	None	None	Bearer	Bearer	Bearer

Key Moments - 3 Insights

Why does the client send client_id and client_secret in the request?

The client_id and client_secret prove the client's identity to the authorization server, as shown in execution_table step 2 and 3 where the server validates these credentials.

What happens if the credentials are invalid?

If credentials are invalid, the server returns an error response instead of an access token, as indicated by the 'No' branch in the concept_flow and would appear in execution_table step 3 with a failure response.

Why does the client use the access token after receiving it?

The access token is used to authenticate API requests, allowing the client to access protected resources, as shown in execution_table step 6 where the token is sent in the Authorization header.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of access_token after step 4?

A "token123"

B None

C "abc"

D "Bearer"

💡 Hint

Check the 'Response' column at step 4 where the server issues the access token.

At which step does the server validate the client credentials?

A Step 1

B Step 5

C Step 3

D Step 6

💡 Hint

Look at the 'Server Validation' column in the execution_table.

If the client_secret was wrong, what would change in the execution flow?

A The server would issue a token anyway.

B The server would return an error instead of a token.

C The client would skip sending the POST request.

D The client would receive a token with a different type.

💡 Hint

Refer to the 'No' branch in the concept_flow and the explanation in key_moments about invalid credentials.

Concept Snapshot

Client Credentials Flow:
- Client sends client_id and client_secret to Auth Server.
- Auth Server validates credentials.
- If valid, server returns access token.
- Client uses token to access protected APIs.
- No user interaction involved.
- Used for server-to-server authentication.

Full Transcript

The Client Credentials Flow is a way for a client application to get an access token from an authorization server by sending its own credentials. First, the client prepares a POST request including its client_id and client_secret. Then, it sends this request to the authorization server's token endpoint. The server checks if the credentials are valid. If they are, the server responds with an access token. The client stores this token and uses it in the Authorization header to access protected APIs. If the credentials are invalid, the server returns an error and no token is issued. This flow is used when no user is involved, such as server-to-server communication.