# OAuth Client Credentials Grant Learn how to get an access token for machine-to-machine requests with the OAuth Client Credentials grant. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) > **PLAN:** This feature requires [at least a Starter plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#starter-features). The Client Credentials grant lets one service get an access token to call another service, with no user involved. The grant runs between two [Entities](https://fusionauth.io/docs/concepts/types/entity-management.md) instead of an Application. To set up the Entities, see [Configure Entities](#configure-entities). The following video shows one use of the Client Credentials grant: [Play](https://youtube.com/watch?v=pJIzYLSTrMM) ## Configure Entities Two Entities take part in a Client Credentials grant. The recipient Entity requests the access token. The target Entity receives requests with the access token and controls access to itself. To learn more about Entities, see [Entity Management](https://fusionauth.io/docs/concepts/types/entity-management.md). For example, a todo API sends email reminders through an email API. The todo API is the recipient Entity, because the todo API receives permissions to call the email API. The email API is the target Entity, because the email API checks the token. To set up the relationship: 1. Create an API [Entity Type](https://fusionauth.io/docs/concepts/types/entity-management.md#entity-types) with the permissions `read` and `write`. 2. Create a todo API Entity and an email API Entity with the API Entity Type. 3. Grant the todo API `read` permission on the email API. You set up the relationship once. After that, the todo API runs the Client Credentials grant whenever the todo API needs to call the email API. You can configure Entities and Grants in the Admin UI or with the API. You can set the **Client Id** and **Client secret** of an Entity, or let FusionAuth generate the values. To create an Entity, navigate to Entity Management -> Entities and click add: ![The Admin UI form to add an Entity.](https://fusionauth.io/img/docs/screenshots/authenticate-entity-add-email-api.png) To add or remove Grants, manage the target Entity: ![The Grants on the manage page of an Entity.](https://fusionauth.io/img/docs/screenshots/authenticate-entity-grants.png) To add a Grant with the API, send the recipient Entity Id and the permissions to the [Entity Grants API](https://fusionauth.io/docs/apis/entities/grants.md): Example Grant Request ```shell API_KEY=... TARGET_ENTITY_ID=e13365f1-a270-493e-bd1b-3d239d753d53 RECIPIENT_ENTITY_ID=2934f41f-d277-4a32-b0d5-16e47dad9721 curl \ -XPOST \ -H "content-type: application/json" \ -H "Authorization: $API_KEY" \ 'https://local.fusionauth.io/api/entity/'$TARGET_ENTITY_ID'/grant' -d' { "grant": { "recipientEntityId": "'$RECIPIENT_ENTITY_ID'", "permissions" : ["read"] } } ' ``` ## Exchange Credentials for an Access Token Send the Client Id and the client secret of the recipient Entity to the `/oauth2/token` endpoint, with **`grant_type`** set to `client_credentials`. The example sends the credentials in an `Authorization: Basic` header, and adds line breaks for readability. Example HTTP Request ```plaintext POST /oauth2/token HTTP/1.1 Host: piedpiper.fusionauth.io Authorization: Basic MDkyZGJkZWQtMzBhZi00MTQ5LTljNjEtYjU3OGYyYzcyZjU5OitmY1hldDlJdTJrUWk2MXlXRDlUdTRSZVoxMTNQNnlFQWtyMzJ2NldLT1E9 Content-Type: application/x-www-form-urlencoded grant_type=client_credentials &scope=target-entity%3Ae13365f1-a270-493e-bd1b-3d239d753d53%3Aread ``` FusionAuth returns the access token: Example JSON Response ```json { "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjM0ZjE3ZDdiNzIifQ.eyJhdWQiOiJlMTMzNjVmMS1hMjcwLTQ5M2UtYmQxYi0zZDIzOWQ3NTNkNTMiLCJleHAiOjE2MjAyMzc3MjksImlhdCI6MTYyMDIzNDEyOSwiaXNzIjoiaHR0cHM6Ly9sb2NhbC5mdXNpb25hdXRoLmlvIiwic3ViIjoiMjkzNGY0MWYtZDI3Ny00YTMyLWIwZDUtMTZlNDdkYWQ5NzIxIiwianRpIjoiMGIwMmY1MDktYmNmMy00YjhkLWEzZGItMDNmOThhY2U5ZDlmIiwicGVybWlzc2lvbnMiOnsiZTEzMzY1ZjEtYTI3MC00OTNlLWJkMWItM2QyMzlkNzUzZDUzIjpbInJlYWQiXX19.1BR367JxpWp33HuHEY0_zHuVDmnYrgi7CzzjlIYwtqQ", "expires_in": 3599, "scope": "target-entity:e13365f1-a270-493e-bd1b-3d239d753d53:read", "token_type": "Bearer" } ``` ## Client Credentials Scopes The **`scope`** parameter names the target Entities and the permissions to request. Separate multiple values with spaces. Each value has the following format: ```plaintext target-entity:entity_id:permission ``` The `entity_id` is the Id of the target Entity and is required. The `permission` is an optional comma-separated list of permissions. To request every permission the recipient has on a target Entity, name only the target Entity: ```plaintext target-entity:92dbded-30af-4149-9c61-b578f2c72600 ``` To request specific permissions, add the permissions after the Entity Id: ```plaintext target-entity:92dbded-30af-4149-9c61-b578f2c72600:read,write ``` To request permissions on several target Entities, list several values: ```plaintext target-entity:92dbded-30af-4149-9c61-b578f2c72600:read,write target-entity:119a84d9-06c5-4d1f-a0d4-a60490b70ac5:read ``` FusionAuth checks the requested permissions against the permissions granted to the recipient Entity. When the recipient has every requested permission, FusionAuth returns an **`access_token`**. When you leave out **`scope`**, FusionAuth still returns an access token for an authorized request. The access token then has no **`aud`** or **`permissions`** claim. Permissions associated with the grant from the target entity to the recipient entity will be available in the `permissions` claim in the token. If specific permissions are requested, the recipient entity must have previously been granted all of those permissions for a successful access request. If specific permissions are requested, only the requested permissions will be in the `permissions` claim, otherwise all permissions will be available in that claim. For every claim in the access token, see [Tokens](https://fusionauth.io/docs/authentication/oauth/tokens.md). Related [APIs Entity API Learn about the APIs for creating, retrieving, updating and deleting entities, as well as searching them. entity managementmachine to machinem2m](https://fusionauth.io/docs/apis/entities/entities.md) [APIs Entity Type API Learn about the APIs for creating, retrieving, updating and deleting entity types. entity managementmachine to machinem2m](https://fusionauth.io/docs/apis/entities/entity-types.md) [APIs Grant API Learn about the APIs for granting and revoking permissions to entities. entity managementmachine to machinem2m](https://fusionauth.io/docs/apis/entities/grants.md) [APIs Entity API Learn about the APIs for creating, retrieving, updating and deleting entities and entity types. entity managementmachine to machinem2m](https://fusionauth.io/docs/apis/entities.md) --- ## Other pages in OAuth > For the full index of this section, see [Authentication](https://fusionauth.io/docs/llms-authentication.txt). - [Add FusionAuth Login to an App You Build](https://fusionauth.io/docs/authentication/oauth/add-login-to-your-app.md): Learn how to add FusionAuth login to a web, mobile, or single-page app you build with an OpenID Connect library and the OAuth Authorization Code grant. - [OAuth Authorization Code Grant](https://fusionauth.io/docs/authentication/oauth/authorization-code.md): Learn how to log users in with the OAuth Authorization Code grant and PKCE. - [CIMD Registration Caching And Lifecycle](https://fusionauth.io/docs/authentication/oauth/cimd-registration-lifecycle.md): Learn how long FusionAuth caches a Client ID Metadata Document, what happens when it expires, and how a CIMD client registration is refreshed or removed. - [OAuth Client Registration | Static and CIMD](https://fusionauth.io/docs/authentication/oauth/client-registration.md): Learn how FusionAuth registers OAuth clients, either ahead of time as Applications or just-in-time from a Client ID Metadata Document. - [OAuth Device Authorization Grant](https://fusionauth.io/docs/authentication/oauth/device.md): Learn how to log users in on TVs and other input-constrained devices with the OAuth Device Authorization grant. - [Use DPoP In A Browser App](https://fusionauth.io/docs/authentication/oauth/dpop/browser-app.md): Learn how to bind tokens to the browser with DPoP using the FusionAuth React, Angular, or Vue SDK. - [Demonstrating Proof-of-Possession (DPoP)](https://fusionauth.io/docs/authentication/oauth/dpop.md): Learn how DPoP binds FusionAuth access and refresh tokens to a key pair that only your client holds. - [Validate DPoP Requests In Your API](https://fusionauth.io/docs/authentication/oauth/dpop/validate-requests.md): Learn how to check DPoP proofs and DPoP-bound FusionAuth access tokens in your API. - [Host A Client ID Metadata Document (CIMD)](https://fusionauth.io/docs/authentication/oauth/host-cimd-document.md): Publish a Client ID Metadata Document so your OAuth client can log in to FusionAuth without being registered ahead of time. - [OAuth](https://fusionauth.io/docs/authentication/oauth.md): Learn about the OAuth 2.0 and OpenID Connect grants FusionAuth supports for login and single sign-on. - [OAuth Issuer Validation](https://fusionauth.io/docs/authentication/oauth/issuer-validation.md): Learn how to validate the authorization response issuer parameter (RFC 9207) to prevent mix-up attacks. - [Legacy OAuth Implicit and Password Grants](https://fusionauth.io/docs/authentication/oauth/legacy-grants.md): Learn how the legacy OAuth Implicit and Password grants work in FusionAuth, for existing integrations. - [Connect claude.ai And chatgpt.com To A FusionAuth-Protected MCP Server](https://fusionauth.io/docs/authentication/oauth/mcp-clients-claude-chatgpt.md): Learn how to connect claude.ai and chatgpt.com to an MCP server protected by FusionAuth using Client ID Metadata Documents. - [Modes](https://fusionauth.io/docs/authentication/oauth/modes.md): Learn about the eight common ways apps use OAuth and OpenID Connect. - [OIDC Prompt](https://fusionauth.io/docs/authentication/oauth/prompt.md): Learn about OpenID Connect prompt and example use cases. - [OAuth Refresh Token Grant](https://fusionauth.io/docs/authentication/oauth/refresh-token.md): Learn how to exchange a refresh token for a new access token with the OAuth Refresh Token grant. - [OAuth Response Modes](https://fusionauth.io/docs/authentication/oauth/response-modes.md): Learn about OAuth 2.0 response modes (query, fragment, form_post) and when to use each one. - [Manage Software Tokens](https://fusionauth.io/docs/authentication/oauth/tokens.md): Learn about OAuth2 and OpenID Connect Tokens and how they are used. - [URL Validation](https://fusionauth.io/docs/authentication/oauth/url-validation.md): Learn about OAuth URL validation policies in FusionAuth.