In server-to-server integrations, which credentials are used to request the access token in the client credentials flow?

• A. Username and password
• B. Public key and private key
• C. Client ID and client secret
• D. OAuth refresh token

Answer: (C)

In server-to-server integrations, the app must prove its own identity to the authorization server to obtain an access token. The way it does this in the client credentials flow is by presenting the application's own credentials: the client ID and the client secret. The app sends these to the token endpoint (often via HTTP Basic authentication or in the request body) with grant_type set to client_credentials. If the credentials are valid, the authorization server issues an access token that the app can use to call APIs on behalf of the application itself.

This differs from scenarios that involve a user context, where a username and password would be used (resource owner password flow). Public/private keys can appear in other forms of client authentication (such as JWT-based client authentication) but the standard client credentials flow relies on the client ID and client secret. A refresh token is not typically issued in this flow because there isn’t a user session to refresh; the client simply authenticates again when the token expires.