The Client Credentials flow facilitates machine-to-machine communications without a user context. Because no user context exists, Okta issues only access tokens, does not generate refresh tokens, and will fail to evaluate user-based claim expressions.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Client Credentials Flow
• Machine-to-Machine Communications

What are the limitations of the Client Credentials flow?

When utilizing the Client Credentials flow, Okta issues only access tokens. Okta excludes ID tokens and strictly reserves them for user-based flows that request the openid scope. Additionally, because this flow does not generate refresh tokens, it lacks a mechanism to automatically renew a session. Consequently, once an access token expires or nears expiration, the application must reinitiate the full authentication process to obtain a new token.

Regarding claim evaluation on a Custom Authorization Server, the absence of user context can lead to specific behaviors when claims rely on user attributes. If custom claims rely on these attributes, the claims resolve to null. This triggers a user_claim_evaluation_failure in the System Log. However, the request succeeds, and Okta successfully mints the access token.

If the sub (subject) system claim relies on user attributes, the /token endpoint fails explicitly with the following error:

The 'sub' system claim could not be evaluated.

Related References

• Implement Client Credentials flow | Okta Developer
• Okta Error Occurs When Requesting OpenID Scopes Using Client Credentials | Okta Support Center