For me, Client Credential flow is like client is asking access token for itself - not on behalf of some user.
Then, why would client like to limit its own scope? What is the benefit of scopes in client credential flow?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
In case a client is requesting the access token for just a specific use case for which only a subset of scopes is required it could make sense that the client narrows down the scope. In case the access token is leaked an attacker would have access to only this use case.