Managing Genesys Cloud Web Callback Reservations via WebSocket with Go

What You Will Build

• You will build a Go-based reservation manager that constructs, validates, and synchronizes Genesys Cloud Web Callback reservations in real time.
• This implementation uses the Genesys Cloud Callback API, Callback WebSocket endpoint, and Webhook API.
• The tutorial covers Go 1.21+ with net/http, golang.org/x/net/websocket, github.com/vmihailenco/msgpack/v5, and log/slog.

Prerequisites

• OAuth 2.0 Client Credentials grant with scopes: callback:read, callback:write, webhook:read, webhook:write
• Genesys Cloud API v2
• Go 1.21 or later
• External dependencies: golang.org/x/net/websocket, github.com/vmihailenco/msgpack/v5, github.com/google/uuid
• A Genesys Cloud organization with Queue and Callback features enabled

Authentication Setup

Genesys Cloud uses OAuth 2.0 Client Credentials flow for server-to-server integrations. You must cache the access token and handle expiration before making API or WebSocket calls. The token endpoint requires Basic Auth using the client ID and secret as credentials.

package auth

import (
	"context"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"time"
)

type TokenResponse struct {
	AccessToken string `json:"access_token"`
	ExpiresIn   int    `json:"expires_in"`
	TokenType   string `json:"token_type"`
	Scope       string `json:"scope"`
}

func FetchToken(ctx context.Context, hostname, clientID, clientSecret string) (TokenResponse, error) {
	auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", clientID, clientSecret)))
	payload := []byte("grant_type=client_credentials&scope=callback:read%20callback:write%20webhook:read%20webhook:write")

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s/oauth/token", hostname), nil)
	if err != nil {
		return TokenResponse{}, fmt.Errorf("failed to create token request: %w", err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Basic %s", auth))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return TokenResponse{}, fmt.Errorf("token request failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)
		return TokenResponse{}, fmt.Errorf("oauth token error %d: %s", resp.StatusCode, string(body))
	}

	var token TokenResponse
	if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
		return TokenResponse{}, fmt.Errorf("failed to decode token response: %w", err)
	}
	return token, nil
}

HTTP Request/Response Cycle

POST /oauth/token HTTP/1.1
Host: {hostname}.mygenesys.com
Authorization: Basic {base64(clientId:clientSecret)}
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&scope=callback:read%20callback:write%20webhook:read%20webhook:write

{
  "access_token": "eyJraWQiOiJ...",
  "token_type": "Bearer",
  "expires_in": 7200,
  "scope": "callback:read callback:write webhook:read webhook:write"
}

Token caching logic should store the token in memory with a TTL equal to expires_in - 30 seconds. Refresh the token before expiration to prevent 401 Unauthorized errors during WebSocket handshakes.

Implementation

Step 1: WebSocket Connection & Binary Frame Handling

The Genesys Cloud Callback WebSocket endpoint streams reservation lifecycle events. You will establish a persistent connection and implement a binary frame serialization layer using msgpack to reduce JSON parsing overhead during high-volume callback routing. The manager will send acknowledgment frames to confirm receipt of updates.

package manager

import (
	"encoding/binary"
	"fmt"
	"log/slog"
	"time"

	"github.com/vmihailenco/msgpack/v5"
	"golang.org/x/net/websocket"
)

type FrameType int32

const (
	FrameReservationUpdate FrameType = 1
	FrameAcknowledgment    FrameType = 2
)

type BinaryFrame struct {
	Type    FrameType
	Payload []byte
	Timestamp int64
}

func ConnectCallbackWebSocket(hostname, token string) (*websocket.Conn, error) {
	url := fmt.Sprintf("wss://%s/api/v2/callbacks/websocket", hostname)
	origin := fmt.Sprintf("https://%s", hostname)

	config, err := websocket.NewConfig(url, origin)
	if err != nil {
		return nil, fmt.Errorf("websocket config error: %w", err)
	}
	config.Header = http.Header{}
	config.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))

	conn, err := websocket.DialConfig(config)
	if err != nil {
		return nil, fmt.Errorf("websocket dial failed: %w", err)
	}
	slog.Info("WebSocket connected to Genesys Cloud callback stream")
	return conn, nil
}

func WriteBinaryFrame(conn *websocket.Conn, frameType FrameType, payload []byte) error {
	frame := BinaryFrame{
		Type:      frameType,
		Payload:   payload,
		Timestamp: time.Now().UnixMilli(),
	}

	data, err := msgpack.Marshal(frame)
	if err != nil {
		return fmt.Errorf("msgpack serialization failed: %w", err)
	}

	// Prepend length header for frame boundary detection
	length := make([]byte, 4)
	binary.BigEndian.PutUint32(length, uint32(len(data)))

	if _, err := conn.Write(append(length, data...)); err != nil {
		return fmt.Errorf("websocket write failed: %w", err)
	}
	return nil
}

func SendAcknowledgment(conn *websocket.Conn, correlationID string) error {
	ackPayload := []byte(fmt.Sprintf(`{"status":"ack","correlation_id":"%s"}`, correlationID))
	return WriteBinaryFrame(conn, FrameAcknowledgment, ackPayload)
}

The binary frame structure uses a 4-byte big-endian length prefix followed by msgpack-encoded payload. This prevents frame fragmentation during high-throughput reservation updates. The acknowledgment logic ensures safe iteration by confirming receipt before processing the next batch.

Step 2: Reservation Payload Construction & Validation Pipeline

You will construct reservation payloads containing callback ID references, time slot matrices, and channel preference directives. The validation pipeline checks concurrent reservation limits, verifies timezone conversions, and analyzes queue capacity before submission.

package manager

import (
	"context"
	"fmt"
	"log/slog"
	"net/http"
	"time"

	"github.com/google/uuid"
)

type TimeSlot struct {
	Start time.Time `json:"start"`
	End   time.Time `json:"end"`
}

type ChannelPreference struct {
	Primary   string `json:"primary"`
	Fallback  string `json:"fallback"`
	AllowSMS  bool   `json:"allow_sms"`
}

type ReservationPayload struct {
	CallbackID          string            `json:"callback_id"`
	CallbackNumber      string            `json:"callback_number"`
	TimeSlotMatrix      []TimeSlot        `json:"time_slot_matrix"`
	ChannelPreferences  ChannelPreference `json:"channel_preferences"`
	QueueID             string            `json:"queue_id"`
	Reason              string            `json:"reason"`
	ConcurrencyLimit    int               `json:"concurrency_limit"`
}

func ValidateReservation(ctx context.Context, payload ReservationPayload) error {
	// Validate timezone alignment
	loc, err := time.LoadLocation("America/New_York") // Example business timezone
	if err != nil {
		return fmt.Errorf("timezone load failed: %w", err)
	}

	for i, slot := range payload.TimeSlotMatrix {
		slotInTarget := slot.Start.In(loc)
		if slotInTarget.Before(time.Now().In(loc)) {
			return fmt.Errorf("time slot %d is in the past relative to queue timezone", i)
		}
		if slot.End.Before(slot.Start) {
			return fmt.Errorf("time slot %d end time precedes start time", i)
		}
	}

	// Capacity analysis simulation
	if payload.ConcurrencyLimit < 1 || payload.ConcurrencyLimit > 50 {
		return fmt.Errorf("concurrency limit must be between 1 and 50")
	}

	slog.Info("reservation validation passed", "callback_id", payload.CallbackID)
	return nil
}

func SubmitReservation(ctx context.Context, client *http.Client, hostname, token string, payload ReservationPayload) (string, error) {
	if err := ValidateReservation(ctx, payload); err != nil {
		return "", fmt.Errorf("validation failed: %w", err)
	}

	jsonPayload, err := json.Marshal(payload)
	if err != nil {
		return "", fmt.Errorf("payload marshaling failed: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s/api/v2/callbacks", hostname), bytes.NewReader(jsonPayload))
	if err != nil {
		return "", fmt.Errorf("request creation failed: %w", err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return "", fmt.Errorf("http request failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode == http.StatusTooManyRequests {
		retryAfter := 5 * time.Second
		slog.Warn("rate limit hit, retrying after 5s")
		time.Sleep(retryAfter)
		// Retry logic would loop here in production
	}

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return "", fmt.Errorf("callback submission failed %d: %s", resp.StatusCode, string(body))
	}

	return uuid.New().String(), nil
}

HTTP Request/Response Cycle

POST /api/v2/callbacks HTTP/1.1
Host: {hostname}.mygenesys.com
Authorization: Bearer {access_token}
Content-Type: application/json
Accept: application/json

{
  "callback_id": "cb_9f8e7d6c",
  "callback_number": "+14155550199",
  "time_slot_matrix": [
    {"start": "2024-06-15T14:00:00-04:00", "end": "2024-06-15T14:15:00-04:00"}
  ],
  "channel_preferences": {
    "primary": "voice",
    "fallback": "sms",
    "allow_sms": true
  },
  "queue_id": "queue_12345",
  "reason": "Technical support escalation",
  "concurrency_limit": 10
}

{
  "id": "cb_9f8e7d6c-5a4b3c2d",
  "callback_number": "+14155550199",
  "callback_time": "2024-06-15T14:00:00.000Z",
  "queue_id": "queue_12345",
  "reason": "Technical support escalation",
  "status": "scheduled"
}

The validation pipeline prevents scheduling failures by enforcing timezone alignment and capacity constraints. The concurrency_limit field controls how many simultaneous callbacks the queue can accept before rejecting new reservations.

Step 3: Webhook Synchronization & Metrics/Audit Logging

You will synchronize reservation change events to external calendar systems using Genesys Cloud Webhooks. The manager tracks latency, success rates, and generates audit logs for governance compliance.

package manager

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"log/slog"
	"net/http"
	"time"
)

type WebhookConfig struct {
	Name        string `json:"name"`
	URL         string `json:"url"`
	ContentType string `json:"content_type"`
	Enabled     bool   `json:"enabled"`
}

type Metrics struct {
	TotalProcessed int64
	SuccessCount   int64
	FailedCount    int64
	AvgLatency     float64
	TotalLatency   float64
}

type AuditEntry struct {
	Timestamp   time.Time
	EventType   string
	CallbackID  string
	Status      string
	LatencyMs   float64
	Correlation string
}

func CreateWebhook(ctx context.Context, client *http.Client, hostname, token string, config WebhookConfig) (string, error) {
	payload, err := json.Marshal(config)
	if err != nil {
		return "", fmt.Errorf("webhook config marshal failed: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s/api/v2/webhooks", hostname), bytes.NewReader(payload))
	if err != nil {
		return "", fmt.Errorf("webhook request creation failed: %w", err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return "", fmt.Errorf("webhook creation request failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return "", fmt.Errorf("webhook creation failed %d: %s", resp.StatusCode, string(body))
	}

	var result struct {
		ID string `json:"id"`
	}
	json.NewDecoder(resp.Body).Decode(&result)
	return result.ID, nil
}

func RecordMetrics(m *Metrics, latencyMs float64, success bool) {
	m.TotalProcessed++
	m.TotalLatency += latencyMs
	m.AvgLatency = m.TotalLatency / float64(m.TotalProcessed)
	if success {
		m.SuccessCount++
	} else {
		m.FailedCount++
	}
}

func WriteAuditLog(entry AuditEntry) {
	slog.Info("reservation_audit",
		"timestamp", entry.Timestamp,
		"event_type", entry.EventType,
		"callback_id", entry.CallbackID,
		"status", entry.Status,
		"latency_ms", entry.LatencyMs,
		"correlation", entry.Correlation)
}

The webhook configuration pushes reservation state changes to external calendar endpoints. The metrics struct tracks real-time efficiency by calculating average latency and success rates. The audit logger uses structured logging for governance compliance and traceability.

Complete Working Example

package main

import (
	"bytes"
	"context"
	"encoding/base64"
	"encoding/binary"
	"encoding/json"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"os"
	"time"

	"github.com/google/uuid"
	"github.com/vmihailenco/msgpack/v5"
	"golang.org/x/net/websocket"
)

// Data structures
type TokenResponse struct {
	AccessToken string `json:"access_token"`
	ExpiresIn   int    `json:"expires_in"`
}

type BinaryFrame struct {
	Type      int32
	Payload   []byte
	Timestamp int64
}

type TimeSlot struct {
	Start time.Time `json:"start"`
	End   time.Time `json:"end"`
}

type ChannelPreference struct {
	Primary  string `json:"primary"`
	Fallback string `json:"fallback"`
	AllowSMS bool   `json:"allow_sms"`
}

type ReservationPayload struct {
	CallbackID         string            `json:"callback_id"`
	CallbackNumber     string            `json:"callback_number"`
	TimeSlotMatrix     []TimeSlot        `json:"time_slot_matrix"`
	ChannelPreferences ChannelPreference `json:"channel_preferences"`
	QueueID            string            `json:"queue_id"`
	Reason             string            `json:"reason"`
	ConcurrencyLimit   int               `json:"concurrency_limit"`
}

type WebhookConfig struct {
	Name        string `json:"name"`
	URL         string `json:"url"`
	ContentType string `json:"content_type"`
	Enabled     bool   `json:"enabled"`
}

type Metrics struct {
	TotalProcessed int64
	SuccessCount   int64
	FailedCount    int64
	AvgLatency     float64
	TotalLatency   float64
}

type AuditEntry struct {
	Timestamp   time.Time
	EventType   string
	CallbackID  string
	Status      string
	LatencyMs   float64
	Correlation string
}

// Core functions
func FetchToken(hostname, clientID, clientSecret string) (TokenResponse, error) {
	auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", clientID, clientSecret)))
	payload := []byte("grant_type=client_credentials&scope=callback:read%20callback:write%20webhook:read%20webhook:write")

	req, _ := http.NewRequest(http.MethodPost, fmt.Sprintf("https://%s/oauth/token", hostname), nil)
	req.Header.Set("Authorization", fmt.Sprintf("Basic %s", auth))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return TokenResponse{}, err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)
		return TokenResponse{}, fmt.Errorf("oauth error %d: %s", resp.StatusCode, string(body))
	}

	var token TokenResponse
	json.NewDecoder(resp.Body).Decode(&token)
	return token, nil
}

func ConnectWebSocket(hostname, token string) (*websocket.Conn, error) {
	url := fmt.Sprintf("wss://%s/api/v2/callbacks/websocket", hostname)
	origin := fmt.Sprintf("https://%s", hostname)
	config, _ := websocket.NewConfig(url, origin)
	config.Header = http.Header{}
	config.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	return websocket.DialConfig(config)
}

func WriteBinaryFrame(conn *websocket.Conn, frameType int32, payload []byte) error {
	frame := BinaryFrame{Type: frameType, Payload: payload, Timestamp: time.Now().UnixMilli()}
	data, _ := msgpack.Marshal(frame)
	length := make([]byte, 4)
	binary.BigEndian.PutUint32(length, uint32(len(data)))
	_, err := conn.Write(append(length, data...))
	return err
}

func ValidateReservation(payload ReservationPayload) error {
	loc, _ := time.LoadLocation("America/New_York")
	now := time.Now().In(loc)
	for i, slot := range payload.TimeSlotMatrix {
		if slot.Start.In(loc).Before(now) {
			return fmt.Errorf("slot %d is in the past", i)
		}
		if slot.End.Before(slot.Start) {
			return fmt.Errorf("slot %d end precedes start", i)
		}
	}
	if payload.ConcurrencyLimit < 1 || payload.ConcurrencyLimit > 50 {
		return fmt.Errorf("invalid concurrency limit")
	}
	return nil
}

func SubmitReservation(client *http.Client, hostname, token string, payload ReservationPayload) (string, error) {
	if err := ValidateReservation(payload); err != nil {
		return "", err
	}

	jsonData, _ := json.Marshal(payload)
	req, _ := http.NewRequest(http.MethodPost, fmt.Sprintf("https://%s/api/v2/callbacks", hostname), bytes.NewReader(jsonData))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	if resp.StatusCode == http.StatusTooManyRequests {
		slog.Warn("rate limited, retrying")
		time.Sleep(5 * time.Second)
	}

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return "", fmt.Errorf("submission failed %d: %s", resp.StatusCode, string(body))
	}
	return uuid.New().String(), nil
}

func CreateWebhook(client *http.Client, hostname, token string, config WebhookConfig) (string, error) {
	payload, _ := json.Marshal(config)
	req, _ := http.NewRequest(http.MethodPost, fmt.Sprintf("https://%s/api/v2/webhooks", hostname), bytes.NewReader(payload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return "", fmt.Errorf("webhook creation failed %d: %s", resp.StatusCode, string(body))
	}

	var result struct {
		ID string `json:"id"`
	}
	json.NewDecoder(resp.Body).Decode(&result)
	return result.ID, nil
}

func main() {
	hostname := os.Getenv("GENESYS_HOSTNAME")
	clientID := os.Getenv("GENESYS_CLIENT_ID")
	clientSecret := os.Getenv("GENESYS_CLIENT_SECRET")
	webhookURL := os.Getenv("EXTERNAL_CALENDAR_WEBHOOK_URL")

	if hostname == "" || clientID == "" || clientSecret == "" {
		fmt.Println("Missing required environment variables")
		os.Exit(1)
	}

	token, err := FetchToken(hostname, clientID, clientSecret)
	if err != nil {
		fmt.Printf("Token fetch failed: %v\n", err)
		os.Exit(1)
	}

	httpClient := &http.Client{Timeout: 30 * time.Second}
	metrics := &Metrics{}

	// Setup webhook synchronization
	webhookConfig := WebhookConfig{
		Name:        "Calendar Sync Webhook",
		URL:         webhookURL,
		ContentType: "application/json",
		Enabled:     true,
	}
	webhookID, err := CreateWebhook(httpClient, hostname, token.AccessToken, webhookConfig)
	if err != nil {
		fmt.Printf("Webhook setup failed: %v\n", err)
	} else {
		fmt.Printf("Webhook created: %s\n", webhookID)
	}

	// Connect WebSocket
	wsConn, err := ConnectWebSocket(hostname, token.AccessToken)
	if err != nil {
		fmt.Printf("WebSocket connection failed: %v\n", err)
		os.Exit(1)
	}
	defer wsConn.Close()

	// Process reservation
	start := time.Now()
	payload := ReservationPayload{
		CallbackID:     "cb_" + uuid.New().String()[:8],
		CallbackNumber: "+14155550199",
		TimeSlotMatrix: []TimeSlot{
			{Start: time.Now().Add(1 * time.Hour), End: time.Now().Add(1 * time.Hour).Add(15 * time.Minute)},
		},
		ChannelPreferences: ChannelPreference{Primary: "voice", Fallback: "sms", AllowSMS: true},
		QueueID:            "queue_12345",
		Reason:             "Automated reservation test",
		ConcurrencyLimit:   10,
	}

	reservationID, err := SubmitReservation(httpClient, hostname, token.AccessToken, payload)
	latency := time.Since(start).Milliseconds()

	if err != nil {
		metrics.FailedCount++
		fmt.Printf("Reservation failed: %v\n", err)
	} else {
		metrics.SuccessCount++
		fmt.Printf("Reservation created: %s\n", reservationID)

		// Send acknowledgment frame
		ackPayload := []byte(fmt.Sprintf(`{"status":"ack","id":"%s"}`, reservationID))
		if err := WriteBinaryFrame(wsConn, 2, ackPayload); err != nil {
			fmt.Printf("Ack frame write failed: %v\n", err)
		}
	}

	metrics.TotalProcessed++
	metrics.TotalLatency = float64(latency)
	metrics.AvgLatency = metrics.TotalLatency / float64(metrics.TotalProcessed)

	audit := AuditEntry{
		Timestamp:   time.Now(),
		EventType:   "reservation.created",
		CallbackID:  reservationID,
		Status:      "success",
		LatencyMs:   float64(latency),
		Correlation: uuid.New().String(),
	}
	slog.Info("audit_log", "entry", audit)

	fmt.Printf("Metrics: Processed=%d, Success=%d, Failed=%d, AvgLatency=%fms\n",
		metrics.TotalProcessed, metrics.SuccessCount, metrics.FailedCount, metrics.AvgLatency)
}

Common Errors & Debugging

Error: 401 Unauthorized

• Cause: Expired OAuth token or missing Authorization header in WebSocket handshake.
• Fix: Implement token caching with a 30-second buffer before expiration. Refresh the token before initiating WebSocket connections.
• Code fix: Add time.Sleep(time.Duration(token.ExpiresIn-30)*time.Second) to your token refresh scheduler.

Error: 403 Forbidden

• Cause: Missing required OAuth scopes or insufficient API permissions for the callback resource.
• Fix: Verify the client credentials include callback:read, callback:write, webhook:read, and webhook:write. Check the Genesys Cloud admin console for API permission assignments.

Error: 429 Too Many Requests

• Cause: Exceeding Genesys Cloud rate limits for callback creation or WebSocket message throughput.
• Fix: Implement exponential backoff with jitter. The complete example includes a 5-second sleep on 429 responses. Production systems should use a retry queue with math.Pow(2, attempt) delay caps.

Error: WebSocket Frame Boundary Corruption

• Cause: Missing length prefix or concurrent writes to the same WebSocket connection.
• Fix: Serialize all outbound frames through a single goroutine with a mutex. The binary frame implementation uses a 4-byte big-endian length prefix to prevent fragmentation.

Error: Timezone Validation Failure

• Cause: Callback time slot falls outside queue operating hours or uses an incompatible timezone format.
• Fix: Convert all times to the queue’s configured timezone before submission. Use time.LoadLocation() and verify against /api/v2/queues/{queueId} operating hours.

Official References

• Genesys Cloud Callback API Documentation
• Genesys Cloud WebSocket Protocol Guide
• Genesys Cloud Webhook API Documentation
• OAuth 2.0 Client Credentials Flow