# 401/403 (unauthorized\_client w/grant type client\_credentials) when requesting token for M2M client

**URL:** <https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954>\
**Category:** Get Help\
**Tags:** m2m, api, client\_credentials, authorization, access-token\
**Created:** [April 1, 2022, 10:26am UTC](https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954 "2022-04-01T10:26:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![joelp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/joelp/32/33352_2.png) [@joelp](https://community.auth0.com/u/joelp)\
**Post date:** [April 1, 2022, 10:26am UTC](https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954/1 "2022-04-01T10:26:26Z")

</div>

I’m sure I’m doing something simple wrong here but I can’t request a token for my M2M client no matter what I try. If I submit my POST request with raw JSON I get a 401 access denied. If I submit my params as application/x-www-form-urlencoded I get the following 403:

```auto
{
    "error": "unauthorized_client",
    "error_description": "Grant type 'client_credentials ' not allowed for the client.",
    "error_uri": "https://auth0.com/docs/clients/client-grant-types"
}

```

These posts seem to be having a similar problem:

> [@Get AccessToken to authorize API](https://community.auth0.com/t/get-accesstoken-to-authorize-api/70426):
>
> Hi there, I have just started with Auth0, got through some videos read the docs and made an small local nodejs client app (localhost:3000) that could authenticate using the forms from Auth0. Then i took a look howto protect an Api and how to access it from that client. What i have so far: Code: NodeJs Client App on localhost 3000 NodeJs API on localhost 3001 - sample code from Auth0 doc that checks the jwt token Auth0: Created an Client called ExpressClient (set the urls; login with id-…

> [@Generate token in WebApi. Error: "Grant type 'client\_credentials' not allowed for the client."](https://community.auth0.com/t/generate-token-in-webapi-error-grant-type-client-credentials-not-allowed-for-the-client/9373):
>
> I'm trying to generate a token in a WebApi so I can call the ManagementApi to update a users's meta\_data. I used code that previously worked for me and received the error: "error":"unauthorized\_client","error\_description":"Grant type 'client\_credentials' not allowed for the client." I understand the grant type of 'client\_credentials' cannot be enabled for clients in the dashboard any longer and when I create the client I need to specify that the endpoint is secret so I added the following to…

Here’s some screenshots of my requests and client and API settings. What am I doing wrong here - any help much appreciated!

Requests (running from Postman to test):

 ![Screen Shot 2022-04-01 at 11.15.11 AM](https://global.discourse-cdn.com/auth0/original/3X/6/8/6825cdc0dbcec2fa651d43865703864227760c5f.png)  
 ![Screen Shot 2022-04-01 at 11.15.20 AM](https://global.discourse-cdn.com/auth0/original/3X/0/a/0ab91bb5e86c2beac1af0295e6e6000eed65cd86.png)

Client:  
 ![Screen Shot 2022-04-01 at 11.16.39 AM](https://global.discourse-cdn.com/auth0/original/3X/7/6/760bba19e768c39b247ca04e62ca085f8f6d4674.png)

 ![Screen Shot 2022-04-01 at 11.16.51 AM](https://global.discourse-cdn.com/auth0/original/3X/c/7/c7b2d43a67e66299e57f735bd17620b82a48ddd3.png)  
 ![Screen Shot 2022-04-01 at 11.17.06 AM](https://global.discourse-cdn.com/auth0/original/3X/c/1/c1958bde45e4f66cd1143c95d6b4963273a0e972.png)

API:

 ![Screen Shot 2022-04-01 at 11.17.27 AM](https://global.discourse-cdn.com/auth0/original/3X/a/1/a171910e94facf85eb5dbd2427a6512f18844b73.png)  
 ![Screen Shot 2022-04-01 at 11.17.54 AM](https://global.discourse-cdn.com/auth0/original/3X/9/7/97f18f6d4ebcb6a3208d036ba254321a92128fcb.png)

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [April 4, 2022, 5:30pm UTC](https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954/3 "2022-04-04T17:30:38Z")

</div>

Hi @joelp,

Thanks for reaching out to the Auth0 Community!

I understand you’re encountering issues getting an access token when performing a client credentials grant flow.

After looking at your screenshots carefully, it seems that you have everything configured correctly for your API.

In this case, could you please go to your [_Auth0 Dashboard \> Applications \> APIs \> YOUR\_API_](https://manage.auth0.com/#/apis) and click on the Test tab.

On there, select your M2M application from the drop down menu, click on cURL, copy that command and import it as raw text in Postman.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/c/1/c1571cbd9d2a5e036418a41fc642cb8091bb5421.jpeg)

Once that is complete, you can request to get an access token for your API.

I have tested this and can confirm that it works without any changes.

Please let me know how this goes.

Thank you.

---

<div class="post-metadata">

**Author:** ![joelp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/joelp/32/33352_2.png) [@joelp](https://community.auth0.com/u/joelp)\
**Post date:** [April 6, 2022, 8:29am UTC](https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954/4 "2022-04-06T08:29:56Z")

</div>

Hi @rueben.tiow thanks for the reply and help.

I can confirm this works and my previous requests now work.

Are you able to explain what happened here and why it started working after importing this cURL request?

Thanks!

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [April 6, 2022, 5:37pm UTC](https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954/5 "2022-04-06T17:37:11Z")

</div>

Hi @joelp,

Thank you for your reply, and I’m glad that it works now!

> [@joelp](#):
>
> Are you able to explain what happened here and why it started working after importing this cURL request?

It’s likely due to the content-type header in your initial request. I have encountered this issue before when the outgoing request had correct values but still returned an error.

Hoped this helps!

Please let me know if there’s anything else I can do to help.

Thank you.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [October 12, 2022, 9:36pm UTC](https://community.auth0.com/t/401-403-unauthorized-client-w-grant-type-client-credentials-when-requesting-token-for-m2m-client/80954/6 "2022-10-12T21:36:00Z")

</div>