The Authorization header can be used in requests consuming the OAuth Toolkit ("OTK"), but may fail at times if the Client ID and Client Secret have been customized, displaying the following error message: The given client credentials were not valid.
There is a current limitation (as of the last modified date on this KB article - latest version of OTK at this time is 4.1) in the OTK which causes the service to reject requests with an Authorization header larger than 128 characters. This limitation is rarely reached, but it can happen if the Client ID and Client Secret are over 64 characters combined, as it will usually amount to an Authorization header over 128 characters after being Base64 encoded.
When this limitation is reached, the only way around it is to modify the Client ID and Client Secret to have a combined character count under 64, which should keep the Authorization header under 128 characters after being Base64 encoded.
The general recommendation is to simply leave the values the OTK assigns to the client to ensure everything is unique and stays away from any limitations.