Put Client Id in url query or payload body instead of `Authorization` header

field to prevent `OPTIONS` request when every api called.