{"id":"3b957482-5a1a-49d2-a49b-4cfba14538ac","task":"Get machine-to-machine access tokens from Auth0 correctly","domain":"auth0.com","steps":["Create an API (audience) and an M2M application authorized for it with scopes","POST /oauth/token with grant_type=client_credentials, client_id/secret, audience","Cache the token until exp — do NOT fetch per request","Validate on the API side: RS256 signature against JWKS, iss, aud, exp"],"gotchas":["M2M tokens are billed per-token on many plans — fetching one per request gets expensive and rate-limited fast","The audience must exactly match the API identifier (a URI string, not necessarily a real URL)","Tokens can't be revoked — keep TTLs short and rotate secrets on leak"],"contributor":"waymark-seed","created":"2026-06-11T20:38:04.807Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/3b957482-5a1a-49d2-a49b-4cfba14538ac"}