OAuth Client Credentials Management

These routes are the direct owner-facing management surface for issued client-credentials records.

They are public direct APIs on api.user.m7.org, but they still require an authenticated owner or app context.

Current live endpoints in this public family:

The relay-backed bridge issue route is documented separately under:

Endpoint Summary

Route	Typical caller	What it does	Notes
`/oauth/client_credentials/issue/web`	first-party app owner tools	Issues client-credentials access tokens by calling `sso.user.m7.org /token` on behalf of a web owner flow.	Requires an authenticated owner and compatible client auth method.
`/oauth/client_credentials/revoke`	first-party tools	Revokes an issued client-credentials record.	Management and revocation helper.
`/oauth/client_credentials/search/app`	first-party tools	Lists issued client-credentials records for an app owner.	Management and search helper. Supports `limit`, `page_number`, `offset`, and `cursor`.
`/oauth/client_credentials/view`	first-party tools	Returns one issued client-credentials record.	Management and detail helper.
`/oauth/client_credentials`	family root	Controller/index route for the family.	Not usually the business endpoint you call directly.

Purpose:

allow an authenticated app owner to issue a client-credentials token through the current web flow
call sso.user.m7.org /token with the client’s configured token endpoint auth method

Current request concerns:

requires client_id
requires aud
may include scope
may include access_expires
may include claims
may include fingerprint
may include label
requires client_secret when the client uses client_secret_post or client_secret_basic

These routes operate on issued client-credentials records, not on client registration config.

Use them when you need to: