Answer
Check for a known, since-fixed defect in how client credentials were sent in the token request before working around it on the receiving end — this has been a confirmed platform issue with a patch introducing an explicit property to control that behavior, so check your patch level rather than building a permanent workaround for it.