3 ms·
the `client_credentials` grant is literally made for server-to-server applications
by DrBenCarson 5y ago
the `client_credentials` grant is literally made for server-to-server applications
- pbreit 5y agoBut why bother with the extra call to request an access token? Makes everything harder for modest security gains.
- loginatnine 5y agoAccess tokens are short lived and can easily be revoked (when opaque). Sending your service credentials to every service is arguably less secure since they can have lesser security or log unwanted things.
- pbreit 5y agoRevocation is actually a major problem with JWTs.