diff --git a/common.py b/common.py
index f7b0f79..4c37d10 100644
--- a/common.py
+++ b/common.py
@@ -172,9 +172,10 @@ async def oauth_token(request: Request):
             if not _verify_pkce(code_verifier, code_data["code_challenge"], code_data["code_challenge_method"]):
                 return JSONResponse({"error": "invalid_grant", "error_description": "PKCE verification failed"}, status_code=400)
 
-        user = client_id
-        if user not in _load_tokens():
-            return JSONResponse({"error": "invalid_client"}, status_code=401)
+        # Verify client_secret at token exchange
+        user = _resolve_client(client_id, client_secret)
+        if not user:
+            return JSONResponse({"error": "invalid_client", "error_description": "Invalid client credentials"}, status_code=401)
 
     elif grant_type == "client_credentials":
         user = _resolve_client(client_id, client_secret)