Some oauth2 servers (for example google's) don't accept both authorization methods for clients (from data and from headers), as the oauth2 standard specifies.