title: Oauth2 client + user access tokens flow
body: <p>I'm using Oauth2 php library. I've followed the docs <a href="http://bshaffer.github.io/oauth2-server-php-docs/grant-types/client-credentials/" rel="nofollow">here</a> and <a href="http://bshaffer.github.io/oauth2-server-php-docs/grant-types/user-credentials/" rel="nofollow">here</a>
  This is what I have so far:</p>
  
  <ul>
  <li>a client application requests a token using client id &amp; client secret
  to the client_credential end point</li>
  <li>a token is returned to the client app with a basic scope</li>
  <li>a user logs in from the client app</li>
  <li>the client application requests a new token using user id &amp; user
  password to the user_credential end point</li>
  <li>the client app receive a new token with the new scope of the user</li>
  </ul>
  
  <p>Everything works. </p>
  
  <p>The only thing that doesn't make sense to me is that I have to pass again the client id &amp; client secret when doing the user authorization (grant_type:'password') otherwise  wise it doesn't work. </p>
  
  <blockquote>
    <p>{"error":"invalid_client","error_description":"Client credentials were not found in the headers or body"}</p>
  </blockquote>
  
  <p>My understanding was that since I obtained first a client token, I wouldn't have to identify the client again. I've tried passing the token instead of client id &amp; client password for user auth but no go. What's the proper grant type combination for what I'm trying to do ?</p>