Is it still relevant to retrieve the client ? because as we discussed in #759 the specification didn't mentioned this kind of behavior.
Moreover, I think that would be weird that a user pass the auth without client credentials but can fail it with wrong credentials.