# Diagnose: M2M token 401

## Symptom

`{"error": "access_denied"}` or 401 from `/oauth/token` with `grant_type=client_credentials`.

## Likely causes

1. The application is not authorized for the API (audience). The M2M app must be granted the API under its APIs tab with scopes.
2. `client_credentials` grant not enabled on the application.
3. Wrong client secret, or the app is public (no secret works).
4. Audience typo: the audience must be the API identifier exactly.

## Confirm

Monitoring > Logs: filter the failed client credentials exchange event. It names the client and the audience attempted. Compare:

- Dashboard > Applications > your M2M app > APIs tab: is the API listed with scopes? If not, that is the bug.
- Settings > Advanced > Grant Types: is client_credentials ticked?
- Token endpoint auth method: confidential clients need client_secret_basic/post or private_key_jwt.

Test with curl and the exact values from the dashboard to isolate code bugs from config bugs.

## Fix

Authorize the app for the API and grant the scopes it needs. Rotate the secret if it leaked, and update the app's stored secret at the same time.

## Verify

curl the token endpoint, get 200, decode the token, confirm `aud` and `scope`. Then confirm the app's own code path works.