Problem description
the value "credentials" in the CIBA workflow authentication isn't clear

Expected action
Define clearly what is expected in the notion "credentials" (basic auth, client_id, token etc.)

Additional context
in the openid standard documentation, credentials are defined with the notion of client_notification_token.
In the Orange implementation, only client_id is used.