Skip to content

Conversation

@pcarleton
Copy link
Member

Oauth 2.1 2.4.1 is about client id and secret:
https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#section-2.4.1

To support clients in possession of a client secret, the authorization server MUST support the client including the client credentials in the request body content using the following parameters:

"client_id":
REQUIRED. The client identifier issued to the client during the registration process described by Section 2.2.

"client_secret":
REQUIRED. The client secret.

But I think we want to explicitly reference the Client Credentials grant in 4.2:

The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server (the method of which is beyond the scope of this specification).

@pcarleton pcarleton requested a review from a team as a code owner November 24, 2025 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants