Machine-to-machine: register the API first, then authorize the app

TL;DR: M2M failures almost always come from doing the steps out of order: the API (audience) must exist before the app can be authorized for it, and scopes must be granted to the app, not just defined on the API. Create the M2M application Applications > Create Application > Machine to Machine. Validate on the API Validate the JWT: signature against the tenant JWKS, iss is YOUR_HOST/, aud is your API identifier, and the scope claim contains what you need.

Machine-to-machine setup

1. Register the API first

Dashboard: Applications > APIs > Create API. Give it a name and an identifier like https://YOUR-API-IDENTIFIER. The identifier becomes the audience value in token requests. Signing algorithm RS256 is the default; keep it.

2. Create the M2M application

Applications > Create Application > Machine to Machine. Auth0 immediately prompts you to authorize it for an API. Select the API from step 1 and tick the permissions (scopes) this app may request. Defining a permission on the API does nothing by itself; the grant to the app is the step that matters.

3. Request a token

curl --request POST   --url YOUR_HOST/oauth/token   --header "content-type: application/json"   --data '{
    "client_id": "[your value]",
    "client_secret": "[your value]",
    "audience": "YOUR-API-IDENTIFIER",
    "grant_type": "client_credentials"
  }'

The response JSON carries the access token in its access token field. Only the client_credentials grant works for M2M apps; the authorization code grant is not available to them.

4. Validate on the API

Validate the JWT: signature against the tenant JWKS, iss is YOUR_HOST/, aud is your API identifier, and the scope claim contains what you need. For Express, express-oauth2-jwt-bearer does this in a few lines.

Checklist

• Grant type client_credentials is enabled on the application (M2M apps have it by default).
• The client authenticates with clientsecretbasic or clientsecretpost; public clients cannot use client_credentials at all.
• Scopes requested are a subset of the scopes granted to the app.
• Never mint M2M tokens per request in a hot loop; cache them until near expiry to stay under /oauth/token rate limits.

When to use this

• This covers exactly what the title says: Machine-to-machine.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Machine-to-machine; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Machine-to-machine behavior.