> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth Client Credentials

> The gateway gets its own access token from an MCP server's OAuth provider and sends it on every request.

With OAuth client credentials, the gateway authenticates to an MCP server or API as itself. It gets an access token from the server's OAuth provider with the `client_credentials` grant, and sends it as `Authorization: Bearer <token>` on every request. Every agent reaches the server under that one identity.

## Settings

The server's `auth` names the provider's token endpoint and the gateway's client:

```json theme={null}
{
  "type": "oauth_client_credentials",
  "token_url": "https://auth.example.com/oauth/token",
  "client_id": "example-client",
  "client_secret": "example-client-secret",
  "scopes": ["orders.read"],
  "audience": "orders-api"
}
```

* `token_url` is the provider's token endpoint.
* `client_id` and `client_secret` identify the gateway. `credentials_in` sends them in the token request's body (`body`, the default) or as HTTP Basic authentication (`basic`).
* `scopes`, `audience`, and `resource` are optional, and go in the token request.

## Token Lifetime

The gateway keeps the token and gets a new one a minute before it expires. A token without an expiry is kept for 5 minutes. When the server answers `401`, the gateway gets a new token and retries the request once.