title: Should you use Client Credentials Grant Type with authenticating server-to-server?
body: <p>I'm creating an api service ("My Api") where the end users are other apis ("Client"). This is my first application where the Client is not an actual person, so I want to make sure I'm going through the authentication flow correctly.</p>
  
  <p>I'm using AWS Cognito and have based the authentication flow off the "Client credentials grant" section of this <a href="https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-user-pool-oauth-2-0-grants/" rel="nofollow noreferrer">post</a>. </p>
  
  <p>The flow I have right now is:</p>
  
  <ol>
  <li>Client registers with My Api</li>
  <li>My Api creates an app client on AWS. I have a simple dashboard that will display the client_id and client_secret to the Client (My Api exposes an endpoint to rotate client_secrets)</li>
  <li>Client sends the following POST to my AWS oauth2 domain</li>
  </ol>
  
  <pre class="lang-sh prettyprint-override"><code>curl -X POST \
    https://[DOMAIN_NAME].auth.[REGION].amazoncognito.com/oauth2/token \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -H 'authorization: Basic BASE64(client_id:client_secret)' \
    -d 'grant_type=client_credentials&amp;scope=[SCOPE]'
  </code></pre>
  
  <ol start="4">
  <li>Client receives access_token in the form of a jwt from AWS</li>
  <li>Client sends access_token in authorization header to My Api</li>
  <li>My Api verifies the access_token is valid</li>
  <li>My Api provides access to resources for the applicable scope and client_id</li>
  </ol>
  
  <p>It seems strange that I have to create an app client on AWS Cognito for each Client. Is that normal when you're authenticating using client credentials instead of an authorization code?</p>
  
  <p>If that's the case, can someone direct me to what the pricing is for each each app client? Is it in the "Users who sign in directly with their User Pool credentials or with social identity providers:" section on this <a href="https://aws.amazon.com/cognito/pricing/" rel="nofollow noreferrer">page</a>? </p>