Machine-to-Machine MCP Authentication
The OAuth Client Credentials extension exists for MCP clients with no human user in the loop, such as CI jobs, background services, and server-to-server automation.
How it differs from user authorization
The client authenticates as an application using client credentials or a supported assertion rather than opening a browser for delegated user consent.
Use narrow service identity
A CI deployment agent should receive only deployment-related scopes for the intended environment. Do not reuse a broad interactive-user token as a machine credential.
Rotate and store safely
Prefer workload identity or signed assertions where supported; otherwise store client secrets in a secret manager and rotate them.