5

For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user.

Then, why would client like to limit its own scope? What is the benefit of scopes in client credential flow?

Improve this question

1 Answer 1

Reset to default
2

In case a client is requesting the access token for just a specific use case for which only a subset of scopes is required it could make sense that the client narrows down the scope. In case the access token is leaked an attacker would have access to only this use case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .