I am thinking of using IdentityServer4 for a new project. I am new to this and have done some reading and seen some of the demo clients in action.

Most of the clients in the samples allow login as a User and issue a token.


I have multiple applications and the are for example, MVC/SPA/Mobile etc. I wish to allow each application to be a client and call an API.

I need a setup where applications can call a protected API without a user being logged in. So the API is protected based on scopes.

I know I can use client_credentials flow to get access_token and call my API. Which is fine for apps like the MVC as the secret will never be exposed.

I read that this flow is not recommended for mobile/SPA apps and to use Authorization Code flow, but I can't seem to get a token without it asking to login as a User.


What other flow can I use to get only access_token without logging in the user and keeping my app secure?

Or, should I just use client_credential flow in my mobile apps and SPA's?

  • Why the client credentials flow is not recommended for SPA or mobile apps? Who is claiming this? – Filipe dos Santos Jan 23 at 17:47
  • Its in the flows section of the documentation. I am also told that its not easy to get the best of both worlds i.e client credentials and code flow. One for calling API without a logged in user and the other for calling it on behalf of a user. – AliK Jan 23 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.