Hello @david.silis,
Welcome to the Community! Are there actual users present in these authentication flows? Client credentials is meant to be used when there is no user present. The term “machine-to-machine” can be misleading here … you can have one API talking to another API, but there can still be a user involved, in which case you should be using something like the authorization code grant flow.