An application credential is proof that lets software authenticate as an application. It may be a client secret, a certificate, or another supported credential. The app presents it to an identity provider to request an access token; the token then permits access within the permissions granted to that application.
Application credentials matter because they can enable automated, app-only access without a person signing in. In cloud integrations, a provider may use one to request tokens for services such as Microsoft Graph. If a credential is exposed or abused, the resulting access can affect tenants that authorized the app. Defenders should protect and rotate credentials, limit application permissions, and review tenant consent, service-principal access, and audit records. Revoking a credential can prevent new token requests, but does not replace checking what access was granted or what activity occurred.