Scenario 6: A batch job needs to call an internal microservice API every night with no user involved. Which OAuth2 grant type fits, and how would you configure the resource server?

Client Credentials grant — the batch job authenticates as itself using its own client_id/client_secret, receiving an access token that represents the SERVICE, not a user. The resource server is configured identically to any other OAuth2 resource server (validating the JWT via JWKS or introspection), since it doesn't need to distinguish machine callers from user-driven ones at the token-validation layer.