> ## Documentation Index > Fetch the complete documentation index at: https://ai.easyaf.dev/llms.txt > Use this file to discover all available pages before exploring further. # ClientCredentialsGrant > Runs the RFC 6749 section 4.4 client credentials grant: a confidential client presents its own identifier and secret and receives an access token, with no en... ## Definition **Assembly:** Microsoft.OData.Mcp.Authentication.dll **Namespace:** Microsoft.OData.Mcp.Authentication.Outbound **Inheritance:** System.Object ## Syntax ```csharp theme={null} Microsoft.OData.Mcp.Authentication.Outbound.ClientCredentialsGrant ``` ## Summary Runs the RFC 6749 section 4.4 client credentials grant: a confidential client presents its own identifier and secret and receives an access token, with no end user and no elicitation anywhere in the path. ## Remarks Per `specs/v3/AUTHENTICATION.md` "Grants → Client credentials" the client authentication method is `client_secret_post` whenever the authorization server advertises it — or advertises nothing at all, which RFC 6749 leaves open — and `client_secret_basic` otherwise; v1 is secret-only, with no client certificate. Per `AUTH-12` the secret is never logged: it travels only in the form or the `Basic` header [TokenEndpointClient](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/TokenEndpointClient.md) builds, and the Information line here carries only the redacted token shape. A client credentials response carries no refresh token — there is no end user session to refresh — so a caller whose access token has expired re-runs this grant rather than looking for one. ## Examples ```csharp theme={null} var response = await grant.AcquireAsync(metadata, "daemon", clientSecret, "read", resource, cancellationToken); var token = response.ToTokenContainer( previousRefreshToken: null, clientId: "daemon", clientSecret: clientSecret, authorizationServer: metadata.Issuer!, tokenEndpointAuthMethod: ClientCredentialsGrant.ResolveAuthMethod(metadata)); ``` ## Constructors ### .ctor Initializes a new instance of the [ClientCredentialsGrant](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/ClientCredentialsGrant.md) class. #### Syntax ```csharp theme={null} public ClientCredentialsGrant(Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointClient tokenEndpointClient, Microsoft.Extensions.Logging.ILogger logger) ``` #### Parameters | Name | Type | Description | | - | - | - | | `tokenEndpointClient` | `Microsoft.OData.Mcp.Authentication.Outbound.TokenEndpointClient` | The client the token POST goes through. | | `logger` | `Microsoft.Extensions.Logging.ILogger` | The logger this instance records the redacted shape of each issued token to. | #### Exceptions | Exception | Description | | - | - | | `ArgumentNullException` | Thrown when *tokenEndpointClient* or *logger* is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null). | ### .ctor Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public Object() ``` ## Methods ### AcquireAsync Obtains an access token for the client itself. #### Syntax ```csharp theme={null} public System.Threading.Tasks.Task AcquireAsync(Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata metadata, string clientId, string clientSecret, string scope, System.Uri resource, System.Threading.CancellationToken cancellationToken) ``` #### Parameters | Name | Type | Description | | - | - | - | | `metadata` | `Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata` | The authorization server metadata whose `token_endpoint` is posted to. | | `clientId` | `string` | The confidential client identifier. | | `clientSecret` | `string` | The client secret; never logged. | | `scope` | `string?` | The space-delimited scope to request, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) to request none. | | `resource` | `System.Uri?` | The RFC 8707 resource indicator, sent exactly as it was published or configured, or [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) when the request sends none. | | `cancellationToken` | `System.Threading.CancellationToken` | The token that cancels the request. | #### Returns Type: `System.Threading.Tasks.Task` The successful token response, which normally carries no refresh token. #### Exceptions | Exception | Description | | - | - | | `ArgumentNullException` | Thrown when *metadata* is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null). | | `ArgumentException` | Thrown when *clientId* or *clientSecret* is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null), empty, or whitespace. | | `InvalidOperationException` | Thrown when *metadata* carries no token endpoint. | | `OAuthTokenException` | Thrown when the authorization server rejects the credentials — `invalid_client` — or when the | | request fails at the transport. | | #### Examples ```csharp theme={null} try { var response = await grant.AcquireAsync(metadata, clientId, clientSecret, scope, resource, cancellationToken); } catch (OAuthTokenException ex) when (ex.Error == "invalid_client") { // ODATA_MCP_CLIENT_SECRET is wrong or the client is not registered. } ``` ### Equals Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual bool Equals(object obj) ``` #### Parameters | Name | Type | Description | | - | - | - | | `obj` | `object?` | - | #### Returns Type: `bool` ### Equals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool Equals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### GetHashCode Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual int GetHashCode() ``` #### Returns Type: `int` ### GetType Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public System.Type GetType() ``` #### Returns Type: `System.Type` ### MemberwiseClone Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} protected internal object MemberwiseClone() ``` #### Returns Type: `object` ### ReferenceEquals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool ReferenceEquals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### ResolveAuthMethod Selects the token endpoint authentication method this grant uses against an authorization server. #### Syntax ```csharp theme={null} public static string ResolveAuthMethod(Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata metadata) ``` #### Parameters | Name | Type | Description | | - | - | - | | `metadata` | `Microsoft.OData.Mcp.Authentication.Outbound.AuthorizationServerMetadata` | The authorization server metadata whose `token_endpoint_auth_methods_supported` is consulted. | #### Returns Type: `string` [TokenEndpointClient.AuthMethodClientSecretPost](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/TokenEndpointClient.md#authmethodclientsecretpost) when the server advertises it or advertises nothing at all; otherwise [TokenEndpointClient.AuthMethodClientSecretBasic](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/Authentication/Outbound/TokenEndpointClient.md#authmethodclientsecretbasic). #### Exceptions | Exception | Description | | - | - | | `ArgumentNullException` | Thrown when *metadata* is [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null). | #### Remarks Public because the caller has to persist the same method on the `TokenContainer` it stores, so a later silent re-acquisition authenticates exactly the way the first one did. ### ToString Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual string ToString() ``` #### Returns Type: `string?` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.