I'm trying to authenticate against a staging environment hosted on demandware.com. I have a Client ID and a client password. 

I can send a request to https://account.demandware.com/dwsso/oauth2/access_token?grant_type=client_credentials and receive an access_token.

But using this access_token the API refuses my request with the error:

    {
    "_v": "19.3",
    "fault": {
        "type": "AccessWithoutUserForbiddenException",
        "message": "An authenticated user is required in order to access the resource."
    }}

I'm not 100% sure but I think I have to authenticate against /dw/oauth2/access_token also?
If so, where can I set the appropiate permissions?
I always get the following error when trying to authenticate (error appears also for the client id I'm using in the request for the access_token):

    {
    "error": "unauthorized_client",
    "error_description": "Client id 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' is not authorized to use grant type 'urn:demandware:params:oauth:grant-type:client-id:dwsid:dwsecuretoken'."}

Do you have an idea?