What token flow is used for server-to-server integrations to obtain an access token?

• A. Authorization Code
• B. Client Credentials
• C. Implicit
• D. Refresh Token

Answer: (B)

For server-to-server integrations, there’s no user present to authorize access. The Client Credentials flow is designed for this scenario: the application authenticates with its own credentials (client_id and client_secret) to the authorization server and receives an access token to call APIs on behalf of the application itself. It doesn’t involve a user login or consent step, unlike the Authorization Code flow, and it isn’t intended for front-channel token exposure like the Implicit flow. The Refresh Token flow is used to obtain new tokens after expiration in flows that involve a user or longer-lived sessions, not to obtain the initial token for a pure server-to-server call.