auth0 error: Grant type client_credentials not allowed for this client

TL;DR

Enable the Client Credentials grant on the Auth0 application (it must be a Machine to Machine application type), or switch to the grant the app actually allows. Auth0 blocks grant types per application, so the fix is in the dashboard setting, not in the request.

auth0 error: Grant type client_credentials not allowed for this client

Steps

1. In the Auth0 dashboard, open the application and check its type. Machine to Machine applications support client_credentials; Single Page and Native apps do not. Expected: you know the app type.
2. If it should be machine-to-machine, either create a Machine to Machine application or enable the Client Credentials grant in the application's Advanced Settings under Grant Types. Expected: the grant appears as allowed for the app.
3. Authorize the application for the target API in the APIs section and grant the scopes it needs. Expected: the app is authorized for the API with the right scopes.
4. Resend the token request with grant_type set to the client credentials value and the client credentials in the body. Expected: Auth0 returns an access token.
5. If the app must stay a user-facing type, switch the integration to the authorization-code flow instead of forcing client credentials. Expected: the flow matches the app type.

Use this when

• Auth0 returns exactly "Grant type client_credentials not allowed for this client".
• A generated client used machine-to-machine auth against an app created for users.
• You control the Auth0 tenant and can change application settings.

Not for this skill when

• The secret is wrong or the client id is wrong - those are different errors.
• You need user login; client credentials is the wrong grant entirely, not just a disabled one.
• The provider is not Auth0; grant-type gating works differently elsewhere.

Variant phrasings

• Auth0 client_credentials grant not allowed
• Auth0 M2M grant type disabled for application
• unauthorized_client grant type not allowed Auth0

Why it happens

Auth0 gates grant types by application type as a security default: a public SPA must not be able to mint tokens with just a client id. Agents generate machine-to-machine token code and point it at whatever application exists, often a user-facing one, and Auth0 refuses the grant at the token endpoint.

Edge cases

• Enabling the grant is not enough; the app also needs the API authorized, or you get a different access-denied error next.
• The Management API has its own authorization step for M2M apps; the token endpoint succeeding does not mean the API call will.
• Tenant-level grant policies can override application settings; if the toggle does not stick, check tenant defaults.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstTVGYZjUUDsWS2YSkbgJDg