How Machine Authentication Works

Wristband uses the OAuth 2.1 Client Credentials Flow to authenticate machines without requiring user interaction.

To authenticate, a machine sends a request to Wristband's Token Endpoint using the client_credentials grant type. The request must include the machine's client ID and client secret in the Authorization header.

If authentication succeeds, Wristband returns an access token that the machine can use to access protected resources. Refresh tokens are not issued as part of this flow because the machine can request a new access token using its client credentials whenever the current token expires.

The following diagram illustrates the high-level interactions between a machine and Wristband during the Client Credentials Flow.

sequenceDiagram
    participant Machine as Your Machine
    participant Wristband as Wristband

    Machine->>Wristband: Request access token (client_credentials)
    Note right of Machine: Authenticates using client ID and secret
    Wristband-->>Machine: Returns access token

Client Registration

Before a machine can authenticate using the client_credentials grant type, a Machine-to-Machine (M2M) Client must be registered in Wristband. During registration, the client is issued a client ID and client secret, which the machine uses to authenticate with Wristband's Token Endpoint.

M2M clients can be registered at either the application level or tenant level, depending on who owns the machine:

• Application-Level M2M Clients: Used for first-party machines owned and operated by your application. These clients are registered at the application level. For configuration details, see the Managing Application Clients documentation.
• Tenant-Level M2M Clients: Used for third-party machines owned or operated by your customers. These clients are registered under the customer's tenant. For configuration details, see the Manage Tenant Clients documentation.