Updated to send client_id and client_secret in POST body