loading
Preparing LoginRadius developer resources
Mission: Help enterprises accelerate digital transformation with our fully-managed Customer IAM technology.
Skip to main content

Machine-to-Machine (M2M) Authorization

Machine-to-machine (M2M) authorization—typically implemented using the Client Credentials grant type defined in RFC 6749: The OAuth 2.0 Authorization Framework—enables secure communication between applications without human intervention. Instead of authenticating individual users, LoginRadius verifies and authorizes trusted devices or applications using predefined credentials and permissions. This ensures systems can exchange data and execute tasks automatically while maintaining strict security measures. By leveraging M2M authorization, businesses can facilitate seamless and secure interactions across their connected systems.

Key Features of M2M:

  • Secure Communication: All interactions, including token exchange and data access, are encrypted to ensure security.
  • Automation: The process is fully automated, eliminating the need for human intervention.
  • Strict Authorization: Only devices or applications with valid credentials and permissions can access the resources.

Common Use Cases

M2M authorization is essential for scenarios that require secure, automated authentication, including:

  • Service–to–service authentication– Allows applications to communicate securely, such as a web application connecting to a cloud database for data retrieval or updates.
  • IoT Device Authorization – Allows smart devices to access cloud services automatically without manual authentication.
  • Third-Party API Integrations – Ensures external services can securely connect to an application’s backend for seamless data exchange.
  • CLI Clients to Internal Services: This feature enables command-line tools to interact securely with internal APIs, ensuring efficient and protected operations.

M2M Authorization Workflow

M2m

The workflow shown in the image illustrates how machine-to-machine (M2M) authorization securely facilitates automated communication between a client-server, a resource server, and the LoginRadius Authorization Server:

  1. Request for Access Token:
    The client-server (partner application or device) initiates the process by requesting the LoginRadius Authorization Server with valid credentials.
  2. Token Generation:
    The LoginRadius Authorization Server checks the credentials. If valid, it issues a JSON Web Token (JWT) that serves as proof of authorization and includes the permissions needed for access.
  3. Trigger Management APIs:
    The client-server uses the JWT to request access to the resource (e.g., profile information via LoginRadius Management APIs). The resource server verifies the JWT with the LoginRadius Authorization Server to ensure it is valid and authorized.
  4. Access to Protected Resources:
    If the JWT is valid, the resource server allows the client-server to access the requested data or resource. This ensures that only trusted devices or applications can interact securely.

Configurations

To manage secure API access with defined permissions, set up and configure a machine-to-machine (M2M) app in LoginRadius. Follow these steps to create an app and configure its authentication settings.

  1. Navigate to Applications in the Console.
  2. Click Add Application.
  3. Enter a unique Application Name and click Create Application.

Your app is now created and you will be taken to the app's configuration page.

Key Terms and Options

This section outlines essential terms and authentication methods required for implementing M2M authorization. Understanding these concepts ensures secure and efficient communication between systems.

LoginRadius supports three methods for authenticating at the token endpoint:

  1. Client Secret Post: Sends the client_id and client_secret in the request body. Ideal for systems that cannot include credentials in headers.
  2. Basic Authentication: Sends the client_id and client_secret as a Base64-encoded string in the Authorization header. Standard and secure when using HTTPS.
  3. Auto: Automatically selects the best authentication method based on the request for easier integration.

Integrations Guide

This guide walks through the implementation of M2M for secure server-to-server authentication without user interaction. The client application can request an access token from LoginRadius using a Client ID and Secret, allowing secure API interactions based on assigned scopes.

Client Credentials Flow

The client application requests an M2M token by sending a POST request to the LoginRadius token endpoint.

API implementations

Generate Access Token API: This API is used to generate an Access Token using Client Credential Flow.

Request Body

{
  "audience": "https://api.loginradius.com/v2/manage",
  "grant_type": "client_credentials",
  "client_id": "<CLIENT_ID>",
  "client_secret": "<CLIENT_SECRET>"
}

Response

{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 86400
}

The access token is returned and will be used for future API calls.

Authenticate Custom APIs

The Client Credentials Flow can also be applied to custom APIs. A token tailored to the specific API can be obtained by specifying a custom audience during the token request, ensuring secure access and communication between systems.

Register the Custom API Resource

Before requesting tokens for a custom API, register it as an API Resource in LoginRadius under Authorization → APIs in the Admin Console. The registration defines the audience identifier, the scopes it exposes, the token TTL, and any token exchange settings.

See API Resources for the full configuration guide — including identifier rules, per-API scopes, token settings, and validation behavior. The same registration powers audience-restricted tokens across Client Credentials, Authorization Code, PKCE, and OIDC flows.

Once your API Resource is registered, use the Identifier URI as the audience value in the token request below.

Send a POST request to generate the Access Token (JWT) with a custom API.

API implementations

Generate Access Token API:This API is used to generate an Access Token

Request Body

{
  "audience": "<CUSTOM_API_ENDPOINT>",
  "grant_type": "client_credentials",
  "client_id": "<CLIENT_ID>",
  "client_secret": "<CLIENT_SECRET>"
}


Revoke Access Token

If an access token needs to be invalidated, revoke it to terminate its validity. Revoking an access token is a security measure that prevents unauthorized access if it is compromised or no longer required.

This process ensures that access to the protected resource is effectively blocked, reinforcing security and minimizing risk.

API implementations

Revoke Access Token API: This API revokes the generated access token(JWT).

📌 Note:

  • The siteurl should be LoginRadius Auth Studio/Custom Domain URL (e.g., companyname.hub.loginradius.com).
  • If using a custom domain, replace siteurl with the custom domain name.

Request Response Structure

Here is a structured table for all request body parameters and responses used in the Client Credentials Flow, along with their descriptions:

Request Body Parameters

ParameterDescription
audienceThe target resource or API the client wants to access (e.g., https://api.loginradius.com/v2/manage). For custom APIs, use the custom endpoint.
grant_typeSpecifies the OAuth 2.0 grant type. Always set as "client_credentials" for M2M authentication.
client_idLoginRadius provides a unique identifier for the m2m application.
client_secretThe secret key is associated with the M2M application. Do not share or expose this value.
scope (optional)This field defines the permissions granted by the token. The default scopes assigned to the application will be used if not provided.

Response

FieldTypeDescription
activebooleantrue if the token is valid and active.
issstringThe token issuer (usually the authentication server).
AUDstringThe intended audience for this token.
substringThe subject identifier (the entity associated with this token).