Client Credentials grant (machine-to-machine)

Use the Client Credentials grant for API calls that do not require user context — your server calling Alianza on its own behalf, not on behalf of a specific user.

The most common use is checking eligibility before prompting the user to sign up. This grant requires the experience-assignability:check scope.

Always act as an OAuth2 confidential client when using the Client Credentials grant.

Token request

POST {baseAuthUrl}/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id={client_id}
&client_secret={client_secret}
&scope=experience-assignability:check

For clarity, examples in this guide are not URL-escaped. Apply URL escaping in real requests.

Token response

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "eyJhbGciOiJSUz...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Using the token

Include the token in every API request:

Authorization: Bearer eyJhbGciOiJSUz...

Caching

Tokens are valid for expires_in seconds (typically 3600). Cache and refresh before expiry; do not request a new token per call.

See also