Our old authentication system logged users in with the OAuth2 client_credentials grant.

If you know OAuth, you just winced. client_credentials exists so that a client application can obtain a token for itself, rather than on behalf of a user. It has no concept of a human being at all. But it takes two values, an ID and a secret, and if you...