we should support this in addition to tokens, since the console only supplies client_id / client_secret for product creators.