OAuth Client Credentials Bridge

This doc covers the private relay-backed client-credentials issue route:

  • /oauth/client_credentials/issue

This route is live on api.user.m7.org, but it is not the public client credentials token endpoint.

Current intended caller:

  • shared SSO helper code behind sso.user.m7.org /token

Current Role

This endpoint:

  • redeems the current relay payload
  • resolves client, tenant, scope, expiry, claims, and fingerprint
  • calls downstream client-credentials issuance on the auth service

Why It Is Private

  • the active caller is the first-party SSO grant helper
  • the route depends on bridge context rather than a clean public token contract
  • the supported public OAuth token endpoint remains sso.user.m7.org /token

Related Public Surface

Do not confuse this bridge route with the owner-facing management helper:

  • /oauth/client_credentials/issue/web

That direct owner-tool route is documented under:

1