lib/oauth2.js
function clientLogin(clientId, clientSecret, done) {
        debug('clientLogin: %s', clientId);

        clientId = parseInt(clientId);
        if (!clientId && clientId !== 0) {
            return done(null, false);
        }

        models.Clients.findByClientId(clientId, function (err, client) {
            if (err) {
                return done(err);
            }
            if (!client) {
                return done(null, false);
            }
            var secret = client.clientSecret || client.restApiKey;
            if (secret !== clientSecret) {
                return done(null, false);
            }
            return done(null, client);
        });
    }
function clientLogin(clientId, clientSecret, done) {
        debug('clientLogin: %s', clientId);

        clientId = parseInt(clientId);
        if (!clientId && clientId !== 0) {
            return done(null, false);
        }

        models.Clients.findByClientId(clientId, function (err, client) {
            if (err) {
                return done(err);
            }
            if (!client) {
                return done(null, false);
            }
            var secret = client.clientSecret || client.restApiKey;
            if (secret !== clientSecret) {
                return done(null, false);
            }
            return done(null, client);
        });
    }
function clientLogin ( clientId , clientSecret , done ) { debug ( 'clientLogin: %s' , clientId ) ; clientId = parseInt ( clientId ) ; if ( ! clientId && clientId !== 0 ) { return done ( null , false ) ; } models . Clients . findByClientId ( clientId , function ( err , client ) { if ( err ) { return done ( err ) ; } if ( ! client ) { return done ( null , false ) ; } var secret = client . clientSecret || client . restApiKey ; if ( secret !== clientSecret ) { return done ( null , false ) ; } return done ( null , client ) ; } ) ; }
BasicStrategy & ClientPasswordStrategy

These strategies are used to authenticate registered OAuth clients.  They are
employed to protect the `token` endpoint, which consumers use to obtain
access tokens.  The OAuth 2.0 specification suggests that clients use the
HTTP Basic scheme to authenticate.  Use of the client password strategy
allows clients to send the same credentials in the request body (as opposed
to the `Authorization` header).  While this approach is not recommended by
the specification, in practice it is quite common.
BasicStrategy & ClientPasswordStrategy