For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user.

Then, why would client like to limit its own scope? What is the benefit of scopes in client credential flow?


In case a client is requesting the access token for just a specific use case for which only a subset of scopes is required it could make sense that the client narrows down the scope. In case the access token is leaked an attacker would have access to only this use case.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.