OAuth 2.0 Client Credentials — Service-to-Service Auth with Client Credentials

// Client credentials token acquisition
async function getClientCredentialsToken() {
  const response = await axios.post('https://auth.example.com/oauth/token', {
    grant_type: 'client_credentials',
    client_id: process.env.SERVICE_CLIENT_ID,
    client_secret: process.env.SERVICE_CLIENT_SECRET,
    audience: 'https://api.example.com',
    scope: 'scan:read scan:write reports:read'
  });

  return {
    token: response.data.access_token,
    expiresAt: Date.now() + (response.data.expires_in * 1000),
    scope: response.data.scope
  };
}

// Token cache with graceful refresh
class ClientCredentialsCache {
  constructor() {
    this.token = null;
    this.refreshMargin = 60000; // Refresh 1 minute early
  }

  async getToken() {
    if (this.token && Date.now() < this.token.expiresAt - this.refreshMargin) {
      return this.token.token;
    }
    this.token = await getClientCredentialsToken();
    return this.token.token;
  }
}

// Service-to-service call
async function callScanService(fileId) {
  const token = await tokenCache.getToken();
  return axios.get(`https://scan-api.internal/scans/${fileId}`, {
    headers: { Authorization: `Bearer ${token}` }
  });
}