This isn't the "OAuth Authorization Code grant" but rather the "Client Credentials Grant". We exchange our application's credentials for an access token. What we're doing can be found at http://support.orcid.org/knowledgebase/articles/117230-tokens-through-client-credential-authorization

The relevant bit:
> Authorization comes from ORCID, not the scholar. Creating new IDs and using the public API through the Member one are a very special OAuth process, ones that don't include the user. Instead the token is granted because the client has privileges to do these functions. (In the case of creating new ORCID iDs, the organization is registered as an Institution.)

(The code is correct, just this jsdoc could be improved)