{"id":"861c7628-4412-4864-bc83-c00c6ef26644","task":"Authenticate to the D2L Brightspace Valence API using the OAuth 2.0 Client Credentials grant for a server-to-server integration","domain":"education","steps":["In Brightspace's Manage Extensibility admin tool, register an OAuth 2.0 application choosing the Client Credential grant workflow, list the scopes your app needs (e.g. grades:gradeobjects:write), and provide an HTTPS URL to your app's JWKS key set.","Have a Brightspace administrator assign a dedicated service user to the app with only the permissions and enrollments the integration needs; each service user can back only one registered app.","Build a JWT client assertion signed with a key from your JWKS set: set header alg to one of RS256/RS384/RS512/ES256/ES384/ES512 and kid to the key identifier, and set payload iss and sub to your app's Client ID, iat/exp (Brightspace recommends 60 seconds or less), and a unique jti.","POST to https://auth.brightspace.com/core/connect/token with grant_type=client_credentials, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, client_assertion=<signed JWT>, and a scope value that is a subset of what you registered.","Send the returned access token as an `Authorization: Bearer <token>` header on subsequent API calls, e.g. GET https://{yourLMShost}/d2l/api/lp/{version}/users/whoami.","Always call over HTTPS, since the access token is a bearer credential usable by anyone who obtains it."],"gotchas":["Requested access token lifetime must be between 1800 and 72000 seconds (30 min-20 hr); the actual token lifetime returned may differ slightly from what you requested, so read it from the response.","Client Credentials Grant apps receive only a Client ID (no client secret) — identity is proven purely via the JWT signed with your JWKS keys, which must be reachable over HTTPS.","If an API action has no specific scope defined for it yet, you must register and request the general fallback scope core:*:* to use it."],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/861c7628-4412-4864-bc83-c00c6ef26644"}