Official documentation and some SFSE answers advise against the use of Username + Password flow (Resource Owner Password Credentials Grant in oauth). The JWT Bearer flow is also recommended as a system-to-system authentication mechanism. See:
- https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_username_password_oauth_flow.htm
- https://help.salesforce.com/articleView?id=remoteaccess_oauth_username_password_flow.htm&type=0
- https://salesforce.stackexchange.com/a/21114/66883
- https://salesforce.stackexchange.com/a/116507/2553
This makes sense in cases where human users are involved. However, in the case of a server-to-server integration where the communication occurs w/out user interaction and where an api-only integration-specific user is set up in Salesforce to control access, is there a benefit to using JWT Bearer Flow over a Username + Password flow?
It would appear that in some ways, the Username + Password flow would reduce risk exposure since it's limited to a single user where JWT Bearer Flow could potentially expose all users with the pre-authorized profile/permset.