code: function clientLogin(clientId, clientSecret, done) {
          debug('clientLogin: %s', clientId);
  
          clientId = parseInt(clientId);
          if (!clientId && clientId !== 0) {
              return done(null, false);
          }
  
          models.Clients.findByClientId(clientId, function (err, client) {
              if (err) {
                  return done(err);
              }
              if (!client) {
                  return done(null, false);
              }
              var secret = client.clientSecret || client.restApiKey;
              if (secret !== clientSecret) {
                  return done(null, false);
              }
              return done(null, client);
          });
      }
docs: BasicStrategy & ClientPasswordStrategy
  
  These strategies are used to authenticate registered OAuth clients.  They are
  employed to protect the `token` endpoint, which consumers use to obtain
  access tokens.  The OAuth 2.0 specification suggests that clients use the
  HTTP Basic scheme to authenticate.  Use of the client password strategy
  allows clients to send the same credentials in the request body (as opposed
  to the `Authorization` header).  While this approach is not recommended by
  the specification, in practice it is quite common.