Struct ClientCredentialsFlow 

pub struct ClientCredentialsFlow {
    pub provider: IdentityProvider,
    pub client_id: String,
    pub client_secret: String,
    pub scopes: Vec<String>,
}

An OAuth2 Client Credentials flow implementation for supported identity providers.

This flow is designed for machine-to-machine (M2M) authentication where no user interaction is required. It exchanges a client secret for an access token directly, without opening a browser.

Provider Requirements

Microsoft Entra ID

• The application must have Application permissions (not Delegated)
• Admin consent must be granted for all requested scopes
• Scopes must use the .default suffix (e.g. api://my-api/.default)

Auth0

• Requires a dedicated Machine to Machine application — a Native app used for PKCE cannot use Client Credentials simultaneously
• Under Advanced Settings → Grant Types, Client Credentials must be enabled
• Scopes are explicit (e.g. read:ez) and must be granted under APIs → Client Access

Fields

provider: IdentityProvider

The resolved identity provider with all required endpoint data.

client_id: String

The Application (Client) ID registered in Entra ID.

client_secret: String

The client secret for the registered application.

Never persisted to disk — always sourced from a prompt or CLI argument.

scopes: Vec<String>

The list of OAuth2 scopes to request.

For Microsoft use .default suffix (e.g. api://my-api/.default). For Auth0 use explicit scopes (e.g. read:ez).

Trait Implementations

impl Authenticator for ClientCredentialsFlow

async fn get_token(&self) -> Result<String>

Exchanges the client credentials for an access token.

Builds an OAuth2 client, adds the requested scopes, and performs the token exchange against the provider’s token endpoint. For Auth0, an audience parameter is included automatically. Displays a spinner during the request.

Errors

Returns an error if:

• The provider produces an invalid token URL
• The HTTP client cannot be initialized
• The token exchange is rejected by the identity provider