4
Support `client_credentials` grant with the OAuth 2.1 Server
Source: supabase/supabase#45382 · opened by @dulacp
The OAuth 2.1 Server beta is awesome. One thing is missing though to support the growth of our business: M2M capabilities, more specifically the client_credentials grant type.
We noticed the docs explicitly calls out that client_credentials and password aren't supported, any chance you would reconsider?
Most of the plumbing seems to be there already, and M2M feels like the natural counterpart to the latest features to support MCP integrations.
Our case: I'm the CTO of a B2B SaaS in Finance. We are starting to get more and more non-user principals (mainly partner integrations) that need to call the API on behalf of a tenant rather than a user. Right now we're running a separate token endpoint just for M2M, because we do not want to do ROPC over a synthetic service account.
Would you be open to a more detailed proposal? Our team would be happy to contribute if it makes sense on your side.
We noticed the docs explicitly calls out that client_credentials and password aren't supported, any chance you would reconsider?
Most of the plumbing seems to be there already, and M2M feels like the natural counterpart to the latest features to support MCP integrations.
Our case: I'm the CTO of a B2B SaaS in Finance. We are starting to get more and more non-user principals (mainly partner integrations) that need to call the API on behalf of a tenant rather than a user. Right now we're running a separate token endpoint just for M2M, because we do not want to do ROPC over a synthetic service account.
Would you be open to a more detailed proposal? Our team would be happy to contribute if it makes sense on your side.
No pledges yet. Be the first to back this.
Comments
Similar requests
OAuth server: an existing grant auto-approves and returns no client details, leaving no room for an account-confirmation step
1 vote · 0 comments
Support OAuth Admin revoke user grant
1 vote · 0 comments
Supabase cli to accept oauth tokens
2 votes · 0 comments
Ephemeral branches need a stable OAuth callback URL
2 votes · 0 comments
Include resource field in OAuth authorization details response
1 vote · 0 comments
No comments yet.