title: Difference between grant_type=client_credentials and grant_type=password in Authentication Flow?
body: <p>I would like to understand the difference between <code>grant_type=client_credentials</code> and <code>grant_type=password</code> in <code>Authentication</code> or in <code>OAuth2 Flow</code> concept.</p>
  <p>I am following below sites:</p>
  <ul>
  <li><a href="http://help.atavist.com/api:authentication" rel="nofollow noreferrer">http://help.atavist.com/api:authentication</a></li>
  <li><a href="http://apiwiki.poken.com/authentication/oauth2" rel="nofollow noreferrer">http://apiwiki.poken.com/authentication/oauth2</a></li>
  </ul>
  <p>I presume <code>grant_type=password</code> is <code>not secure</code> way as far as using <code>grant_type</code> in JavaScript development. But I still wonder if someone can help me to understand this concept.</p>
  <p>I also observed that <code>grant_type=client_credentials</code> doesn't provide &quot;<code>refresh_token</code>&quot;, it only provides <code>access_token</code>  where as <code>grant_type=password</code> provides both <code>access_token</code> and <code>refresh_token</code>.</p>
  <p>Hoping to get detailed explanation. I am using <code>WSO2 API Manager</code> for OAuth2 for my application development</p>