Machine-to-Machine Authorization

Authenticate your backend services or daemon scripts without user interaction.

---

When to use this flow?

Use the Client Credentials Flow when:

• You have a backend service (daemon, cron job, CLI tool)
• No human user is present to log in
• The application is accessing its own resources, not a specific user's data

Note: This flow bypasses the login screen. The application authenticates itself directly using its client_id and client_secret.

---

Prerequisites

1. Create a Confidential Client in the SyAuth Dashboard (select "Machine-to-Machine" or "Regular Web App").
2. Ensure you have the client_id and client_secret.
3. Enable client_credentials grant type for your application (if applicable).

---

Step 1: Request Access Token

Make a POST request to the token endpoint directly:

curl

curl -X POST https://api.syauth.com/e/v1/oauth/token/ \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=openid"

Python

import requests

response = requests.post("https://api.syauth.com/e/v1/oauth/token/", data={
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "scope": "openid"
})

tokens = response.json()
print(tokens['access_token'])

Node.js

const response = await fetch('https://api.syauth.com/e/v1/oauth/token/', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: 'YOUR_CLIENT_ID',
    client_secret: 'YOUR_CLIENT_SECRET',
    scope: 'openid'
  })
});

const tokens = await response.json();
console.log(tokens.access_token);

---

Step 2: Use the Token

The response will contain an access_token (but usually not a refresh_token, as you can just request a new one anytime using the client credentials).

{
  "access_token": "eyJhbG...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Use this token to call protected APIs:

curl https://api.syauth.com/e/v1/oauth/userinfo/ \
  -H "Authorization: Bearer ACCESS_TOKEN"

---

Important Security Notes

• ⚠️ NEVER expose your client_secret in frontend code (React, Vue, mobile apps). This flow is strictly for secure backends.
• If your client_secret is compromised, rotate it immediately in the Dashboard.