OAuth 2.0 Client Credentials Flow: no client credentials user enabled

Question

Getting this error when trying to run a curl following the OAuth 2.0 Client Credentials Flow for Server-to_Server integration:

{"error":"invalid_grant","error_description":"no client credentials user enabled"}

The curl (redacted info for CONSUMER_SECRET, CONSUMER_KEY and DOMAIN):

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=CONSUMER_KEY&client_secret=CONSUMER_SECRET" \
  "https://DOMAIN.my.salesforce.com/services/oauth2/token"

The target tenant is running Salesforce Enterprise Edition. My Managed Package with my App is installed and runs as a user with the System Administrator Profile. I have the correct Consumer Key and Consumer Secret for the App and got DOMAIN from Setup -> My Domain in the target tenant.

The documentation states, "This flow eliminates the need for explicit user interaction, though it does require you to specify an execution user to run the integration."

Any thoughts as to why the initial request is failing?

Answer 1

You need to configure the connected app for this flow and attach a User to it.

At the oAuth protocol level, Client Credentials flow is designed to not require a user identity. Client id and secret are attributes of your app (client) rather than you (the user wielding the app). Since all execution contexts in SF are tied to users, this flow requires you to be explicit about the user identity for this transaction. From the doc:

1. Create your connected app and complete its basic information.
2. Configure the necessary OAuth settings for the connected app.
3. Enable the client credentials flow for your connected app. Under API (Enable OAuth Settings), select Enable Client Credentials Flow.
4. Select an execution user for the flow. Although there’s no user interaction in the client credentials flow, Salesforce still requires you to specify an execution user. By selecting an execution user, you allow Salesforce to return access tokens on behalf of this user. [...] The execution user must have the API Only permission.