skills.rest
overlens
overlensOFFICIAL
Explore all skills by this author →
WebsiteGitHub

idp-integrate-m2m

Implements OAuth 2.0 client_credentials machine-to-machine authentication against the Overlens IDP.

Updated Jul 24, 2026
Search Tags:#authentication#jwt#api integration#oauth2#machine-to-machine#client credentials#overlens
One-click install
npx skills add https://github.com/overlens/claude-marketplace --skill idp-integrate-m2m-overlens
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: idp-integrate-m2m
Source: https://github.com/overlens/claude-marketplace/tree/main/plugins/idp-integration/skills/idp-integrate-m2m
Command: npx skills add https://github.com/overlens/claude-marketplace --skill idp-integrate-m2m-overlens

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes references (resource) components.

What problem does it solve? Backend services like workers, cron jobs, and microservices need to call Overlens APIs on their own behalf, but wiring up OAuth 2.0 client_credentials correctly — token caching, scope-based authorization, secret handling — is error-prone and often confused with the user login flow. ## Core Features & Use Cases - Copy-paste M2M client templates: Ready-made TypeScript/NestJS, Python, and Go clients that fetch tokens via POST /auth/token and cache them in memory until exp − 30s, avoiding 429 rate-limit errors. - Client registration guidance: Exact POST /admin/clients payload for a confidential M2M client (isPublic:false, allowedGrantTypes:['client_credentials'], redirectUris:[], exhaustive allowedScopes) plus required environment variables. - Resource Server authorization patterns: Scope guards and user-vs-M2M discrimination (client_id present, email absent) for the API consuming the token. - Use Case: A developer needs a nightly billing worker to call api.overlens.com.br. They register an M2M client, drop in the TypeScript template, set four env vars, and the worker obtains and reuses 5-minute Bearer tokens automatically. ## Quick Start Ask the assistant to integrate Overlens machine-to-machine authentication into your backend service using the client_credentials flow.

Frequently Asked Questions about idp-integrate-m2m

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I authenticate a backend service to the Overlens API without a user login?▼

Use the OAuth 2.0 client_credentials grant: POST to https://idp.overlens.com.br/auth/token with Basic auth (client_id:client_secret) and grant_type=client_credentials. The response is a 5-minute RS256 JWT you send as a Bearer token to the target API.

How do I cache an M2M access token to avoid rate limits?▼

Cache the token in memory and reuse it until 30 seconds before expiry, since POST /auth/token is throttled at 30 requests per minute per IP. The provided TypeScript, Python, and Go templates implement this caching with concurrency protection out of the box.

What is the difference between client_credentials and authorization_code flows?▼

client_credentials is for services acting as themselves: no browser, redirect, PKCE, cookies, or refresh token, and the JWT carries client_id and scope instead of email and role. authorization_code is for human users logging in via browser or mobile.

Why does my M2M token request return 401 invalid_client?▼

A 401 invalid_client means an unknown client_id, a wrong client_secret, or a public client attempting M2M. M2M clients must be registered with isPublic:false since the client_secret is their only credential.

Can an M2M service token call Overlens admin endpoints?▼

No. Admin endpoints under /admin/* require a user JWT with role=ADMIN, and M2M tokens are rejected by AdminRoleGuard by design. There is no M2M path to admin operations.

How should a Resource Server authorize requests from M2M tokens?▼

Authorize by scope, never by role, because M2M tokens contain client_id and scope but no role or email. Detect a service token with payload.client_id present and payload.email absent, then check the required scope against the token's scope claim.

Related Skills

Explore More Software Engineering Skills→
pulzzepulzze

interactor-auth

Authenticates backend systems to Interactor platform using OAuth2 client credentials.

Official
Intermediate
sergiodxasergiodxa
5

sdxc-jwt

Issues and verifies JWTs with typed claim accessors, key rotation, and JWKS publishing.

Community
Intermediate
naviktnavikt
52

nav-auth

Implement Azure AD JWT validation and TokenX exchange for Nav applications.

Official
Advanced
zenobiuszetozenobiuszeto

spring-security

Configures Spring Boot 3.x APIs with OAuth2/JWT authentication and RBAC via @PreAuthorize and Authority mapping.

Community
Advanced