M2M token request 401s: grant types, audience registered, client auth method

TL;DR: Symptom: POST /oauth/token with client_credentials returns 401/403. Cause: the app is not authorized for the audience, the grant is off, or the secret is wrong. The M2M app must be granted the API under its APIs tab with scopes. Audience typo: the audience must be the API identifier exactly.

The fix

1. The application is not authorized for the API (audience). The M2M app must be granted the API under its APIs tab with scopes.
2. client_credentials grant not enabled on the application.
3. Wrong client secret, or the app is public (no secret works).
4. Audience typo: the audience must be the API identifier exactly.
5. Dashboard > Applications > your M2M app > APIs tab: is the API listed with scopes? If not, that is the bug.
6. Settings > Advanced > Grant Types: is client_credentials ticked?
7. Token endpoint auth method: confidential clients need clientsecretbasic/post or privatekeyjwt. Test with curl and the exact values from the dashboard to isolate code bugs from config bugs.

When to use this

• This covers exactly what the title says: M2M token request 401s.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with M2M; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current M2M behavior.

Auth0's application grant types doc requires confidential clients for client_credentials and documents the token endpoint auth methods. The M2M authorization flow is documented in the backend quickstart. Verified against live docs 2026-09-26.