So, in M2M applications, it’s very easy to select scopes for the API and control, what can be done using clientId & clientSecret. But what are the risks of leaked clientId & clientSecret in Regular Web Application? Can someone realistically use id/secret form Regular Web App to login on someones …

Hey there @toomuchtimeondocs ! [image] toomuchtimeondocs: But what are the risks of leaked clientId & clientSecret in Regular Web Application? Because there is no user interaction, leaked M2M credentials (depending on what they are authorized for) could be used to create access tokens direct…

Regular Web Application - clientSecret dangers

Get Help

system Closed October 3, 2023, 10:34pm 4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to give M2M credentials without knowing the client secret? Get Help	3	2057	October 28, 2021
Client id for web app AND for machine to machine. Is this allowed -> Get Help apis , application	2	1216	September 14, 2023
M2M Applications - Client credentials flow so a user can consume an API with a secret key Get Help machine-to-machine	3	4343	July 23, 2020
Securely allow external applications access to M2M tokens using organizations Get Help apis , application	4	56	March 26, 2025
Doubt about "Client Secret" and Applications types Get Help jwt , auth0 , client-secret	4	2832	December 14, 2021

Regular Web Application - clientSecret dangers

Related topics