Skip to main content

M2M (Machine-to-Machine)

M2M apps are for backend-only integrations where no end-user login is involved. They use the OAuth 2.0 Client Credentials flow to obtain access tokens for backend services.

M2M is NOT for User Login

M2M applications are server-to-server ONLY for accessing ChainIt public APIs (KY, KYB, Pactvera, File Upload). For user authentication, use IDP or Hosted UI instead.

Machine-to-Machine Access

Credentials
  • Token endpoint, scopes, and which permissions to request for least privilege.
  • Authenticate with your M2M app's clientId and clientSecret (for example HTTP Basic or a JSON body, per your environment).
  • Attach the bearer token in the Authorization header for protected API requests.

This clip walks through the M2M server-to-server path end to end: you configure an M2M application and API scopes in the Developer Portal, authenticate to the OAuth token endpoint with your clientId and clientSecret using the client credentials grant, receive a bearer access token for your organization, and call ChainIT APIs from trusted backend services only—never exposing the secret to browsers or mobile clients.

M2M Properties in Developer Portal​

M2M applications are focused on backend permissions. They support a limited set of properties:

PropertySupportedDescription
scopes✅API permissions (e.g., FILE_UPLOAD, MINTING).
tokenManagement❌Uses organization-level default expiration (24 hours).
branding❌No UI involves; branding is not applicable.
callbackURL❌No redirection involves in server-to-server flows.

Architecture​

M2M apps communicate directly between your server and the ChainIT Auth API.

Obtaining an Access Token​

Make a POST request to the token endpoint with your client credentials.

Token Request​

curl -X POST "https://staging-api.chainit.online/oauth/token" \
-H "Content-Type: application/json" \
-u "{clientId}:{clientSecret}" \
-d '{
  "accessTokenScopes": ["FILE_UPLOAD", "MINTING"]
}'
M2M Token Scope Usage

M2M tokens are scoped to your organization's API permissions. They cannot be used to call the UserInfo API as they lack a user context (sub).

Node.js​

Use M2M from a Node process: call the token endpoint with the client credentials grant using your M2M clientId and clientSecret, read the access token from the response, then call ChainIT APIs with a bearer Authorization header. Adapt the Token Request example above to fetch (Node 18+), axios, or your HTTP client—keep secrets in server-side environment variables only, never in browser bundles.

Next steps​

Next steps