Please bear with me for asking stupid questions.

I'm trying to authenticate against a staging environment hosted on demandware.com. I have a Client ID and a client password.

I can send a request to https://account.demandware.com/dwsso/oauth2/access_token?grant_type=client_credentials and receive an access_token.

But using this access_token the API refuses my request with the error:

{
"_v": "19.3",
"fault": {
    "type": "AccessWithoutUserForbiddenException",
    "message": "An authenticated user is required in order to access the resource."
}}

I'm not 100% sure but I think I have to authenticate against /dw/oauth2/access_token also? If so, where can I set the appropiate permissions? I always get the following error when trying to authenticate (error appears also for the client id I'm using in the request for the access_token):

{
"error": "unauthorized_client",
"error_description": "Client id 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' is not authorized to use grant type 'urn:demandware:params:oauth:grant-type:client-id:dwsid:dwsecuretoken'."}

Do you have an idea?

Thanks, Hannes