title: Understanding client_id and client_secret
body: <p>A bit of a beginner to OAUTH and wanted to ask if I understood something correctly. I'm using OWIN and C# and I setup the following scenario:</p>
  
  <ol>
  <li><p>a user makes a request to my token endpoint, passing in a username/password with a grant_type of password. If the credentials are valid, then I create a JWT.</p></li>
  <li><p>The user gets back a JWT, and then the client uses that token going forward for all requests</p></li>
  <li><p>Any requests that require authorization I use the token's claims to ensure the user is allowed to make this request.</p></li>
  </ol>
  
  <p>So where does the client_id and client_secret come into this? Is this just an extra layer of security to say "before you can even get a token, you need to pass me <em>another</em> set of credentials (id/secret) and only if <em>those</em> are valid, in addition to your username/password provided, can you get back a JWT?</p>
  
  <p>Would like to understand who the two relate - Thanks so much!</p>