Skip to content
Keycloak — From Zero to Hero

Client Credentials Grant

What is the Client Credentials grant?

Section titled “What is the Client Credentials grant?”

The Client Credentials grant is designed for machine-to-machine calls where there is no user. Instead of a user authenticating, the client authenticates itself using its client_id and client_secret. Because there is no user in the flow, Keycloak returns only an access token — there is no ID token.

This grant is part of the OAuth2 specification and is the standard approach for service accounts, background jobs, and any automated process that needs to call a protected API.

When to use it

Section titled “When to use it”

Use the Client Credentials grant for:

  • Background jobs calling an internal API
  • Microservices calling each other
  • CI/CD pipelines provisioning infrastructure

Do not use it for anything where a real user is involved. If a user must authenticate and your app needs to act on their behalf, use Authorization Code + PKCE instead.

Setting up in Keycloak

Section titled “Setting up in Keycloak”
  1. Create a confidential client (set Client authentication to On).
  2. Enable Service Accounts — on the Capability config tab, enable Service account roles.
  3. Copy the client secret from the Credentials tab.
  4. Assign realm roles or client roles to the service account user on the Service Accounts Roles tab if your API checks roles in the token.

Requesting a token

Section titled “Requesting a token”
curl -X POST https://${KC_URL}/realms/${REALM}/protocol/openid-connect/token \
  -d "grant_type=client_credentials" \
  -d "client_id=${CLIENT_ID}" \
  -d "client_secret=${CLIENT_SECRET}"
When should you use the Client Credentials grant?
What does Keycloak return for a successful Client Credentials request?
Which Keycloak setting must be enabled on the client for Client Credentials?
Which client type is required for Client Credentials?