Getting "Bearer token malformed" for oauth2

Ok, so for one, the password grant requires you create a basic auth user, not just encode the client ID and secret.

So I’d suggest to just try and debug the client credentials call because the one for password is completely wrong and you missed a step in the doc for that type (where it says “create a user”)

One thing that is incorrect in the doc is that the Client must have a redirect URL even if it isn’t used.

Does your client have a redirect URL set?