# Grant type 'client\_credentials' not allowed for the client

**URL:** <https://community.auth0.com/t/grant-type-client-credentials-not-allowed-for-the-client/92240>\
**Category:** Get Help\
**Tags:** api, management-api, login\
**Created:** [October 12, 2022, 1:28pm UTC](https://community.auth0.com/t/grant-type-client-credentials-not-allowed-for-the-client/92240 "2022-10-12T13:28:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bilal](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/bilal/32/39881_2.png) [@bilal](https://community.auth0.com/u/bilal)\
**Post date:** [October 12, 2022, 1:28pm UTC](https://community.auth0.com/t/grant-type-client-credentials-not-allowed-for-the-client/92240/1 "2022-10-12T13:28:32Z")

</div>

Hey guys. I have been stuck in an unwanted flow. I am using a SPA for the front end. When the SPA calls the token api for auth access\_token, it gives me the token, now I need to pass that token to my backend (nestJS) and do some work there. But I am getting this error. Can anyone please help .  
  
  ![Screenshot 2022-10-12 at 6.22.26 PM](https://global.discourse-cdn.com/auth0/original/3X/c/4/c46a230be4fa1ecba12c682494c1a812596773a3.png)

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [October 12, 2022, 9:43pm UTC](https://community.auth0.com/t/grant-type-client-credentials-not-allowed-for-the-client/92240/3 "2022-10-12T21:43:09Z")

</div>

Hello @bilal welcome to the community!

Where exactly are you getting this error? From your code it looks like the token endpoint (`oauth/token`)?

Typically this error is spot on, that is whatever client is requesting the token (in this case your SPA) using client credentials doesn’t support the grant type. Client credentials are only used for [confidential](https://auth0.com/docs/get-started/applications/confidential-and-public-applications#confidential-applications) applications like [M2M](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow).

Keep us posted!

---

<div class="post-metadata">

**Author:** ![bilal](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/bilal/32/39881_2.png) [@bilal](https://community.auth0.com/u/bilal)\
**Post date:** [October 18, 2022, 12:41pm UTC](https://community.auth0.com/t/grant-type-client-credentials-not-allowed-for-the-client/92240/4 "2022-10-18T12:41:44Z")

</div>

Hey .  
Yes that was helpful. I had to create a separate application for my backend which was an M2M app.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 1, 2022, 12:42pm UTC](https://community.auth0.com/t/grant-type-client-credentials-not-allowed-for-the-client/92240/5 "2022-11-01T12:42:19Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.