← All practicals

A token with no user (client credentials)

Mint a service token for machine-to-machine calls — no human, no id_token, no refresh.

1. 1

   Register a confidential app with the Client Credentials grant, then POST /oidc/token with grant_type=client_credentials & scope=api.

   There’s no user in the loop — the client authenticates as itself with its secret and asks only for the non-openid `api` scope (openid/email are rejected).

2. 2

   Inspect the token: an opaque access token, no id_token, no refresh_token.

   A service identity has nothing to “sign in” — so no ID token and no offline refresh; the token’s subject is the owning account, not a person.

3. 3

   Try it against /oidc/userinfo and watch it get 403 insufficient_scope.

   UserInfo is an OpenID endpoint; an `api`-only machine token can’t read user claims — least privilege enforced at the resource.