refactor oauth client api: add transparent credentials passing