With the help of Mike Durran (thanks and kudos), I implemented the Resource Owner oauth flow (username/pwd) with OAP. The client credentials flow is not supported.
Initial user/pwd to get access token, then refresh token until expiration, regular pwd rotation.
Alternatives?