Service-to-service API calls
A backend service calls another protected service without requiring a user session.
Kinde · Const
M2M tokens
M2M tokens are OAuth 2.0 access tokens for backend services, scripts, and automation that operate without a user. Kinde issues them through the client credentials flow for an API audience, with optional scopes and organization context.
How it works
An M2M token is a JWT access token obtained without user interaction through OAuth 2.0's client credentials flow. Kinde issues it for an authorized API audience, and the token's scopes and claims determine what the calling service can do.
Syntax
POST https://<your-subdomain>.kinde.com/oauth2/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=<your-client-id>&client_secret=<your-client-secret>&audience=<your-api-audience>Parameters
| Name | Type | Description |
|---|---|---|
grant_type | form field | OAuth grant identifier; use client_credentials. |
client_id | form field | Public identifier of the M2M application. |
client_secret | form field | Secret credential for the M2M application. |
audience | form field | API identifier the token is intended to access. |
Returns
An access token for the requested API audience, used as a Bearer token in subsequent API requests.
Key points
- M2M authentication is intended for service-to-service, scripted, and automated workloads where no end user participates.
- The authentication mechanism is OAuth 2.0 client credentials, using application credentials rather than a user login.
- The issued access token can authorize calls to Kinde APIs or APIs operated by your application.
- Scopes constrain the permissions carried by the token and should reflect the application's required access.
- Organization-scoped M2M applications add trusted organization context through the
org_codeclaim.
Common mistakes
- A token is valid only for the API audience supplied during issuance; using it against another audience will fail.
Example: Request an M2M access token
curl --request POST \
--url 'https://<your-subdomain>.kinde.com/oauth2/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--data 'grant_type=client_credentials' \
--data 'client_id=<your-client-id>' \
--data 'client_secret=<your-client-secret>' \
--data 'audience=<your-api-audience>'Requests an M2M access token using the client credentials flow; send the returned token as a Bearer token when calling the matching API.
When to use it
Automation and scheduled tasks
A scheduled job or deployment script accesses an API automatically.
Organization-isolated integrations
A multi-tenant integration must constrain credentials to one organization.
Interview questions
QHow does Kinde issue an M2M token?
Kinde obtains an M2M token through OAuth 2.0 client credentials. The request includes the client ID, client secret, grant type, and API audience; the resulting token can authenticate backend calls without a user.
Follow-up: How would you restrict an M2M client? Authorize the application for the target API and grant only the scopes required by that service.
QHow is an M2M token used and validated?
The token is sent in the HTTP Authorization header using the Bearer scheme. The API should validate that the token's audience matches the API it serves before accepting it.
Follow-up: What additional claim can support tenant isolation? An organization-scoped M2M application produces a token containing the relevant org_code claim.
QWhat happens when an M2M token expires?
Access tokens are valid for one hour by default. M2M applications do not receive refresh tokens, so a service must obtain a new token with its client credentials after expiry.
Follow-up: What operational concern follows from that lifetime? Cache tokens until near expiry, then perform a new client-credentials request rather than refreshing them.
Related
OAuth 2.0 client credentials flowclient_idclient_secretaudiencescopeorg_codeBearer tokenorganization-scoped M2M application