Securing Server-to-Server API Calls

Use Client Credentials flow to authorize service accounts without user context.

In this lesson, you will learn how to secure communication between two backend services using the OAuth 2.0 Client Credentials flow, completely bypassing the need for a user context.

Understanding the Machine-to-Machine Context

When two services talk to each other—such as an Inventory Service requesting data from a Shipping Service—there is no logged-in human user to provide a token. In these scenarios, we use the Client Credentials flow. Instead of identifying a user, the calling service (the "Client") authenticates itself as an application using its own unique ClientId and ClientSecret.

The authorization server treats the service account as an identity with specific scopes, allowing it to perform actions on its own behalf. This is the gold standard for backend integration because it isolates service permissions from user permissions.

Implementing the Flow

To acquire a token in C#, we typically use IdentityModel to reach out to the token endpoint. Here is a simplified look at how a service requests an access token:

var client = new HttpClient();
var disco = await client.GetDiscoveryDocumentAsync("https://identity-server.com");

// Request the token using the service's credentials
var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
{
    Address = disco.TokenEndpoint,
    ClientId = "inventory-service",
    ClientSecret = "a-very-secure-secret",
    Scope = "shipping.read"
});

// Use the token to call the protected API
var apiClient = new HttpClient();
apiClient.SetBearerToken(tokenResponse.AccessToken);
var response = await apiClient.GetAsync("https://shipping-api.com/status");

Why This Matters

By using this flow, you ensure that the receiving API doesn't have to guess who is calling it. It validates that the request came from a trusted, authenticated system. Because no user context is involved, you avoid the "Confused Deputy" problem by assigning the service exactly the scopes it needs—and nothing more. Treat these credentials like administrative keys; they are the keys to your kingdom and should be managed via secure configuration providers, never hardcoded in your source files.

Key Takeaway: Use the Client Credentials flow for server-to-server communication to authenticate services as distinct identities with defined, limited permissions, entirely independent of user sessions.