if client_credentials.get('type') not in ('authorized_user', 'service_account'):

For the record, just depending on strings is going to get us into trouble one day. Let's not worry about that here.