API Testing · Middle · Question 28 of 75
In the OAuth 2.0 client credentials flow, who gets the token?
- 1A database that stores user passwords
- 2An application acting on its own behalf
- 3A user who logs in through a browser
Show the answer
Correct answer: An application acting on its own behalf
Explanation
Service-to-service calls use client ID and secret to get a token. There's no user, so user-level scopes don't apply.