Machine-to-Machine Access

Adding and managing M2M apps

Requesting a machine-to-machine client and calling an API with it

Report issue

A machine-to-machine (M2M) app is a client with no user present: a backend service, a job, or a script calling an API on its own behalf. This page walks through requesting one, getting a token, and making a first authenticated call. See Registering an app for how M2M compares to the other app types.

Before you start

  • Access to the sandbox tenant
  • curl and jq, or an HTTP client of your choice

1. Request a client

Use the appropriate link below to request a client for your app.

2. Store your credentials

Keep the client secret out of source control. Use the secret store your app already uses.

3. Request an access token

$curl --request POST \
>  --url https://dev-piy7cd4hrpai3k88.us.auth0.com/oauth/token \
>  --header 'content-type: application/json' \
>  --data '{
>    "grant_type": "client_credentials",
>    "client_id": "<client-id>",
>    "client_secret": "<client-secret>",
>    "audience": "<api-audience>"
>  }'

The response contains an access_token and its lifetime in expires_in. Cache the token and reuse it until shortly before it expires rather than requesting one per call.

4. Make your first request

$curl --request GET \
>  --url https://id.core.sandbox.jminsure.com/users/auth0%7C64chjsi3f2fd/metadata \
>  --header 'authorization: Bearer <access-token>'

5. Confirm your scopes

A 403 with a Missing required scope message means the token is valid but the client is not authorized for that operation. See Assigning scopes to M2M apps.

What to do next