# Regulating Access Token use by External APIs

**URL:** <https://community.auth0.com/t/regulating-access-token-use-by-external-apis/90799>\
**Category:** Get Help\
**Tags:** machine-to-machine\
**Created:** [September 16, 2022, 7:09pm UTC](https://community.auth0.com/t/regulating-access-token-use-by-external-apis/90799 "2022-09-16T19:09:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![f8DhZh3P](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/f8dhzh3p/32/13599_2.png) [@f8DhZh3P](https://community.auth0.com/u/f8DhZh3P)\
**Post date:** [September 16, 2022, 7:09pm UTC](https://community.auth0.com/t/regulating-access-token-use-by-external-apis/90799/1 "2022-09-16T19:09:54Z")

</div>

Hi there,

I have enterprise customers that would like to access my API programatically. It appears the way to do this is using the Client Credentials flow:

1. Create a new M2M Application for each enterprise customer.
2. Give the customer the client id and secret
3. The customer will exchange the client id and secret for an access token using the M2M Application
4. The customer will send requests to my API with that access token
5. When the access token expires, the customer will exchange their client id and secret for a new access token

My concern is that the Auth0 subscription plan only allows for a limited number of access tokens per month. How can I prevent an enterprise customer from fetching a new access token for every request, or even fetching new access tokens prematurely, and burning through the M2M token amount provided with my subscription? Thank you.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 1, 2022, 12:50am UTC](https://community.auth0.com/t/regulating-access-token-use-by-external-apis/90799/3 "2022-10-01T00:50:52Z")

</div>

Hi @f8DhZh3P,

There is a bit of a gap for this type of use case at the moment. It would be helpful to create a [Feature Request](https://community.auth0.com/c/feedback/95) so we can gauge interest. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 15, 2022, 12:51am UTC](https://community.auth0.com/t/regulating-access-token-use-by-external-apis/90799/4 "2022-10-15T00:51:44Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.