> In general, use the Authorization Code grant if there is a human being involved and the Client Credentials grant if you are performing server to server commun

> In general, use the Authorization Code grant if there is a human being involved and the Client Credentials grant if you are performing server to server communication. This is the crux of the article. We're integrating with a vendor now that has imo chosen incorrectly to use auth code instead of client credentials. This leads to several problems. One is that we need to store their refresh tokens, which go stale after 2 weeks. Since it's theoretically possible that the customer doesn't use the integration for 2 weeks, we need to preemptively use the refresh tokens ourselves behind the scenes every 2 weeks to prevent this. When the vendor changes tech behind the scenes, they just chuck away all existing tokens, so we then need to contact all customers asking them to log in again in order to get new refresh tokens. It sucks and it's brittle as hell. Tldr; don't use auth code grants (the ones most people think oauth is) for server to server integrations.