Machine-to-machine: register the API first, then authorize the app

# Machine-to-machine setup

## 1. Register the API first

Dashboard: Applications > APIs > Create API. Give it a name and an identifier like `https://YOUR-API-IDENTIFIER`. The identifier becomes the `audience` value in token requests. Signing algorithm RS256 is the default; keep it.

## 2. Create the M2M application

Applications > Create Application > Machine to Machine. Auth0 immediately prompts you to authorize it for an API. Select the API from step 1 and tick the permissions (scopes) this app may request. Defining a permission on the API does nothing by itself; the grant to the app is the step that matters.

## 3. Request a token

```
curl --request POST   --url https://YOUR-TENANT-DOMAIN/oauth/token   --header "content-type: application/json"   --data '{
    "client_id": "[your value]",
    "client_secret": "[your value]",
    "audience": "YOUR-API-IDENTIFIER",
    "grant_type": "client_credentials"
  }'
```

The response JSON carries the access token in its access token field. Only the `client_credentials` grant works for M2M apps; the authorization code grant is not available to them.

## 4. Validate on the API

Validate the JWT: signature against the tenant JWKS, `iss` is `https://YOUR-TENANT-DOMAIN/`, `aud` is your API identifier, and the `scope` claim contains what you need. For Express, `express-oauth2-jwt-bearer` does this in a few lines.

## Checklist

- Grant type client_credentials is enabled on the application (M2M apps have it by default).
- The client authenticates with client_secret_basic or client_secret_post; public clients cannot use client_credentials at all.
- Scopes requested are a subset of the scopes granted to the app.
- Never mint M2M tokens per request in a hot loop; cache them until near expiry to stay under /oauth/token rate limits.