title: What is the security difference between API Keys and the client credentials flow of OAuth?
body: <p>Consider an API that a client accesses directly (machine to machine) and that doesn't require user-specific authentication. The way I understand it, in <code>client_credentials</code>, the client must store a <code>client_id</code> and <code>client_secret</code> that it uses to acquire and refresh tokens. With an API key, the client just stores the key. What makes OAuth more secure in this case? It would appear to me that if the API key is never compromised, no attacker could pose as the intended client. And if the API key is compromised, it is effectively the same as compromising the <code>client_id</code> and <code>client_secret</code>, which an attacker would be able to use to obtain tokens and access the data in the API, posing as the client.</p>
  <p>edit: clarified this is a machine-to-machine call</p>