A wastewater SCADA integration can call a machine-only API with client credentials, but the resident portal must let each homeowner approve data sharing. Why does official DEVCOR task 2.5 require the authorization-code (three-legged) path for that portal?
Select an answer to reveal the explanation.
Short Explanation
Machine-to-machine is a two-person handshake without the homeowner. Three-legged invites the homeowner to the table to say yes. Client-credentials skips that consent, so it is not the official 2.5 happy path.
Full Explanation
The authorization-code grant is three-legged because the resource owner participates—authenticating and approving access. Client-credentials is a two-legged machine grant with no user consent and may appear only as a discarded path for this task. Official DEVCOR 2.5 focuses on that user-in-the-loop code grant, not on claiming refresh tokens or dropping client secrets.