Authenticate to the D2L Brightspace Valence API using the OAuth 2.0 Client Credentials grant for a server-to-server integration

Steps

1. In Brightspace's Manage Extensibility admin tool, register an OAuth 2.0 application choosing the Client Credential grant workflow, list the scopes your app needs (e.g. grades:gradeobjects:write), and provide an HTTPS URL to your app's JWKS key set.
2. Have a Brightspace administrator assign a dedicated service user to the app with only the permissions and enrollments the integration needs; each service user can back only one registered app.
3. Build a JWT client assertion signed with a key from your JWKS set: set header alg to one of RS256/RS384/RS512/ES256/ES384/ES512 and kid to the key identifier, and set payload iss and sub to your app's Client ID, iat/exp (Brightspace recommends 60 seconds or less), and a unique jti.
4. POST to https://auth.brightspace.com/core/connect/token with grant_type=client_credentials, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, client_assertion=<signed JWT>, and a scope value that is a subset of what you registered.
5. Send the returned access token as an `Authorization: Bearer <token>` header on subsequent API calls, e.g. GET https://{yourLMShost}/d2l/api/lp/{version}/users/whoami.
6. Always call over HTTPS, since the access token is a bearer credential usable by anyone who obtains it.