Client Credentials missing from Access Policy Rule editor in Free Trial Plan tenant (API Services app)

Questions OAuth/OIDC
1

Hi Team,

I’m seeing unexpected behavior in a newly created Okta tenant and would like to understand whether this is expected behavior, a tenant entitlement limitation, or a UI defect.

Tenant Type - This issue is occurring in an Okta Free Trial Plan tenant.

The Admin Console shows: - FREE TRIAL PLAN

Created an application using:
Applications → Create App Integration → API Services
Name - AllegroWebCore

Application Configuration
Application settings:
Application Type: Service
Grant Types:
✓ Client Credentials

The General Settings page shows:
Application type: Service
Grant type:
Client acting on behalf of itself
:check_box_with_check: Client Credentials

Authorization Server Configuration:
Security → API → Authorization Servers → default
Created an Access Policy:
Policy Name: Server To Server
Assigned clients: AllegroWebCore

Issue:
When I click Add Rule under the Access Policy, the Grant Type section only displays:
Authorization Code
Device Authorization

The following section is missing:
Client acting on behalf of itself
:check_box_with_check: Client Credentials

Additional Observation

I also reviewed the Okta support article:

< Okta Support Center (Lightning) >

The article states that, for a grant type to be authorized:

  1. The grant type must be enabled on the client application.
  2. The grant type must be enabled in the Authorization Server Access Policy Rule. [support.okta.com]

In my tenant:
Application Type: Service
Grant Types:
✓ Client Credentials

However, the Rule editor does not provide any option to enable Client Credentials, making it impossible to complete the configuration described in the support documentation.

Troubleshooting Performed

I have already tried:

  1. Creating a brand-new API Services application.
  2. Creating a brand-new Access Policy.
  3. Assigning only the new Service App to the policy.
  4. Testing in Incognito mode and a different browser.
  5. Verifying that the application type is Service.
  6. Verifying that Client Credentials is enabled on the application.
  7. Verifying that the Authorization Server and Access Policy are configured correctly.

The behavior remains the same.

Questions

  1. Is Client Credentials expected to appear in the Access Policy Rule editor for Service Apps in an Okta Free Trial Plan tenant?

  2. Has there been any recent change related to Service Apps, machine-to-machine applications, or Non-Human Identity capabilities that changes how Client Credentials rules are configured?

  3. Is this a known Admin Console UI issue, feature flag issue, or tenant-specific entitlement limitation?
    Let me know if you need any more info.

Include These Screenshots

  1. Service App General Settings

    • Application Type = Service
    • Client Credentials enabled

  2. Access Policy

    • Assigned only to AllegroWebCore

  3. Add Rule dialog

    • Showing only Authorization Code and Device Authorization

    image
    image1814×1688 192 KB

2

Hi,

Currently, the Free Orgs don’t support the Client Credential flow type. So this is an expected behaviour.

3

Hi @abhijit.mali ,

Welcome to the community!

As @vk-giri mentioned, this is expected in Integrator Free Org plans. As it is a new change, I’d love to understand your use case so I can advocate for our dev community’s needs. Thank you for posting this and alerting us to what you tried.

If you feel comfortable sharing more information about how you’re using this Okta org and the work you need to do with it, please feel free to DM. I’m gathering stories like yours to present to the Product team.

Happy coding!