Yes, I was talking about the ```/oauth2.0/profile```.
I may be mistaken, but I have a very different vision here !
- Using the *implicit*, *authorization_code* or the *password* grant type, an *access token* has been granted to the OAuth client to access this ressource on behalf of the user : I would expect the url to have a filter to authenticate from an *access token*
- Using the *client credentials*, the OAuth client directly accesses this url by providing its credentials : I would expect some filter authenticating OAuth client.

Am I completely wrong here ?