Our product allows 3rd party components to talk to it via web services using an API key (a 'bearer token'). The developer of the component generates the API key in our app and then stores it with their component.
We were recently asked by a few customers about switching to OAuth2 instead of simple API keys for improved security.
We need to use the Client Credential Grant Type for this as there is no 'user' involved in the flow. However, this requires storing the client id and secret along with the component.
How is this more secure than just storing an API Key with the component? Don't they have the same attack surface (anyone with access to that component can spoof it)?