Per the discussion on T417278 and T407987, the OAuth 2 client credentials flow could fulfill a role similar to bot passwords and owner-only apps, and – unlike them – it is a standard thing and allows us to take advantage of JWTs for access control.

However, our current implementation is that all requests authenticated by client credentials are treated as logged-out. We would like to add a new mode where they are treated as logged-in as the app's owner.

Requirements

(roughly in order of importance)

• Do not change anything for existing client credentials apps (do not make them act as logged in) [T417278#11672588]
• Add an explanation when choosing client credentials flow during app registration, since the proposed behavior, while allowed, is not typical [T417278#11634423 T407987#11674162]
• Make client credentials and authorization code mutually exclusive for newly registered apps [T417278#11648812]
• Relax review for client credentials apps to be more like owner-only apps [T417278#11650829]
• Allow filtering app listings by whether the app uses client credentials or authorization code flow [someone said this somewhere, maybe in Slack]
• ...