# Diagnose: M2M token 401
## Symptom
`{"error": "access_denied"}` or 401 from `/oauth/token` with `grant_type=client_credentials`.
## Likely causes
1. The application is not authorized for the API (audience). The M2M app must be granted the API under its APIs tab with scopes.
2. `client_credentials` grant not enabled on the application.
3. Wrong client secret, or the app is public (no secret works).
4. Audience typo: the audience must be the API identifier exactly.
## Confirm
Monitoring > Logs: filter the failed client credentials exchange event. It names the client and the audience attempted. Compare:
- Dashboard > Applications > your M2M app > APIs tab: is the API listed with scopes? If not, that is the bug.
- Settings > Advanced > Grant Types: is client_credentials ticked?
- Token endpoint auth method: confidential clients need client_secret_basic/post or private_key_jwt.
Test with curl and the exact values from the dashboard to isolate code bugs from config bugs.
## Fix
Authorize the app for the API and grant the scopes it needs. Rotate the secret if it leaked, and update the app's stored secret at the same time.
## Verify
curl the token endpoint, get 200, decode the token, confirm `aud` and `scope`. Then confirm the app's own code path works.