How does machine to machine authorization work? And, how to use it (M2M)

Learn about the power of machine-to-machine Authorization 🤖

Machine to machine communications are a part of most modern architectures. OAuth 2.0 and Auth0 by Okta provide the building blocks to make it easy to implement. We'll learn about how the client credentials grant is simple approach to the problem of authorization between autonomous and semi-autonomous system. From backend-to-backend, daemons, IoT devices, and even CLI tools,

🔗 Relevant Links:

⏩ Chapter Markers:
00:00 - Introduction
00:37 - Machine to Machine Communications
01:36 - Client Credentials Grand Overview
02:02 - How the Client Credentials Grant Works
03:06 - What a Client Credentials Grant Request Looks Like
03:34 - Creating a M2M Application in Auth0
04:43 - Use Cases for M2M Communications
07:37 - Conclusions

If you enjoy this content and want to learn more about identity, security, OpenID Connect, SAML, passkeys, and all things access management, subscribe to our channel! Have topic you'd like to see covered? Let us know if the comments 👀

___________________________________________
Learn with Auth0 by Okta
Follow Us on Social

#MachineAuthorization #IdentityManagement #Security #AccessManagement #DeveloperTutorial #TechExplained #API #AuthorizationTechnology #DeveloperTips #TechInnovation

[cliffmathew]

You completely skipped how the resource server validates an access token presented by the client, before allowing access.

[nicholas]

Good stuff, helpful terminology and use case review.

[zacktzeng]

Hi you mentioned that client credential grant should only be used for trusted services and not internet facing services. If i have a public web app with frontend and backend and i want to only allow this public web backend to access my custom backend resources, should i pick a different method? If so, what wouls you recommend? Thanks!!

[christopherkirkos]

I want to run automated tests in my staging environment, but I have to simulate a user to do so (need email address associated with token). How should I achieve this?

[mohanchennagiri]

@2:30, how does the resource-server ensure the access-token is authentic? Is there implicit trust, or does it call authorization server to validate the token?

[ahsath]

isn't IoT devices not a trusted client if they operate autonomously like a vending machine in a parking lot that make requests to a DB aka resource? I say this because they are susceptible to be stolen and reversed engineered to get the "secrets"