oauth: client interface