OAuth 2.0 client credentials is a machine-to-machine authentication flow used by confidential software clients that act on their own behalf. Instead of a user logging in, the application presents its client identity and secret, or another trusted assertion, to the authorization server and receives an access token for an API.
This matters in cyber security because many modern services, bots, workloads, and AI agents need non-human identities. The main risks are leaked client secrets, overly broad scopes, and tokens that last too long. Attackers often try to steal a client secret or token, then reuse it to call APIs as if they were the application. Defenders reduce that risk with short-lived tokens, secret rotation, vaulting, least-privilege scopes, strong audit logging, and workload identity systems where possible.