This grant is suitable for machine-to-machine authentication, for example for use in a cron job which is performing maintenance tasks over an API. Another example would be a client making requests to an API that don’t require user’s permission.
The client sends a POST request with following body parameters to the authorization server:
grant_type with the value client_credentials
client_id with the client’s ID
client_secret with the client’s secret
scope with a space-delimited list of requested scope permissions.
The authorization server will respond with a JSON object containing the following properties:
token_type with the value Bearer
expires_in with an integer representing the TTL of the access token
access_token a JWT signed with the authorization server’s private key
Wherever you initialize your objects, initialize a new instance of the authorization server and bind the storage interfaces and authorization code grant:
Please note: These examples here demonstrate usage with the Slim Framework; Slim is not a requirement to use this library, you just need something that generates PSR7-compatible HTTP requests and responses.
The client will request an access token so create an /access_token endpoint.