https://blog.mishraji.org/tags/entra/ Recent content in Entra on mishraJi Hugo en-us Sun, 23 Aug 2026 00:00:00 +0000 https://blog.mishraji.org/posts/client-secret-vs-certificate-based-authentication/ Sun, 23 Aug 2026 00:00:00 +0000 https://blog.mishraji.org/posts/client-secret-vs-certificate-based-authentication/ <h1 id="certificate-vs-client-secret-in-the-client-credentials-flow">Certificate vs Client Secret in the Client Credentials Flow</h1> <h2 id="introduction">Introduction</h2> <p>Most OAuth flows are about a <em>user</em> proving who they are. The <strong>client credentials flow</strong> is the odd one out — there is no user. It is machine-to-machine. A backend service, a daemon, a scheduled job — something with no human sitting in front of it — needs to call an API and prove <em>it</em> is who it claims to be.</p>