Client Credentials

Environment and endpoints

Production issuer is https://accounts.appforges.com; staging is https://accounts-staging.appforges.com. Browser authorization uses the issuer's /oauth2/authorize, and token exchange uses /oauth2/token. Business APIs use the matching API domain. Do not use REST /v1/oauth/authorize as a browser login URL.

Create an OAuth client in application Credentials with Public/Confidential mode, redirect URIs and allowed scopes. Copy the actual client_id; app_id is a different identifier. Public clients use PKCE S256 without client_secret; Confidential secrets stay on secure backends.

Service calls

client_credentials applies to a Confidential client registered for that grant and endpoints accepting its service identity. Authenticate as registered and submit grant_type=client_credentials with permitted scopes to the issuer token endpoint. Applications do not automatically have this grant.

A service token cannot call user-only GET /v1/users/me. Check supported identities, credentials and scopes in API Reference. Request a fresh token after expiry; do not assume a refresh_token is issued.

For user identity use user authorization.