Describe how an API client transmits client_id and client_secret to a web API protected by client ID enforcement — typically as HTTP headers, sometimes as query parameters for legacy clients.