When should OAuth 2.0 authorization code flow be used versus client credentials flow for a custom extension?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Todd Lammle: 'Imagine you're building a chatbot and this exact situation comes up — use authorization code when the api requires user-specific access tokens; use client credentials for service-to-service authentication is your go-to move. Authorization code flow is appropriate when the API issues tokens on behalf of individual users and requires user consent. This is a classic Domain 6: Build Back-End Integrations concept you'll want locked in before exam day.'
Full explanation below image
Full Explanation
Authorization code flow is appropriate when the API issues tokens on behalf of individual users and requires user consent. Client credentials flow is used for server-to-server authentication where the application acts on its own behalf. The distinction is based on whether user identity is involved; not on read/write access; hosting location; or response format. The correct answer, "Use authorization code when the API requires user-specific access tokens; use client credentials for service-to-service authentication", directly satisfies the scenario because it aligns with watsonx Assistant's design principles and the specific capability being tested. The incorrect options ("Use authorization code for read-only APIs; use client credentials for write operations", "Use authorization code for IBM Cloud APIs; use client credentials for external APIs", "Use authorization code for text responses; use client credentials for binary responses") may appear relevant but each misses a key requirement or introduces a step that is either unnecessary or belongs to a different workflow. Mastering the distinction between these approaches is essential for effective watsonx Assistant implementations and is a core focus of the Domain 6: Build Back-End Integrations section of the certification exam.