M2M application

An M2M application represents a backend service, script, or automation tool rather than a person. It uses OAuth 2.0 client credentials: the service sends its client ID and secret, receives an access token, and uses that token for authorized API calls.

POST /oauth2/token with grant_type=client_credentials, client_id, client_secret, and audience

An OAuth access token that can be sent as a bearer token to an authorized API.

const tokenResponse = await fetch(`https://${process.env.KINDE_DOMAIN}/oauth2/token`, {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "client_credentials",
    client_id: process.env.KINDE_CLIENT_ID!,
    client_secret: process.env.KINDE_CLIENT_SECRET!,
    audience: process.env.API_AUDIENCE!
  })
});

if (!tokenResponse.ok) throw new Error("Token request failed");
const { access_token } = await tokenResponse.json();

const apiResponse = await fetch(`${process.env.API_URL}/records`, {
  headers: { Authorization: `Bearer ${access_token}` }
});

console.log(await apiResponse.json());

The service exchanges its M2M credentials for an access token, then presents that token when calling the protected API.