Deprecation of Password Grant flow leaves a gap in authenticating a client as its own user about oauth.net HOT 2 CLOSED

This isn't really the place for questions like this, this repo is just for the oauth.net website, not for discussing spec issues. That said, what you're describing of "a user internal to the client" sounds like an overloading of the password grant in the first place. You're probably better off using the Client Credentials grant since there isn't really an end user in this flow at all.

from oauth.net.

@aaronpk thanks for your response. I see now that this repo is more for the website and therefore not the appropriate place for the question.

However, you answer has been very helpful and I'm now a littler clearer on the fact the the spec deals more with the concept of the end user. So in that sense the Client Credentials grant is appropriate for authenticating a client as a user within the context of the API but not where a single Client ID may enable multiple end users to log in as was the case with the password grant.

from oauth.net.