diff --git a/internal/form/client_credentials_test.go b/internal/form/client_credentials_test.go
new file mode 100644
index 000000000..367cb7b9b
--- /dev/null
+++ b/internal/form/client_credentials_test.go
@@ -0,0 +1,56 @@
+package form
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClientCredentials_Validate(t *testing.T) {
+	t.Run("Valid", func(t *testing.T) {
+		m := ClientCredentials{
+			ClientID:     "cs5gfen1bgxz7s9i",
+			ClientSecret: "abc",
+			AuthScope:    "*",
+		}
+
+		assert.NoError(t, m.Validate())
+		assert.Equal(t, "*", m.Scope())
+	})
+	t.Run("NoClientID", func(t *testing.T) {
+		m := ClientCredentials{
+			ClientID:     "",
+			ClientSecret: "Alice123!",
+			AuthScope:    "*",
+		}
+
+		assert.Error(t, m.Validate())
+	})
+	t.Run("InvalidClientID", func(t *testing.T) {
+		m := ClientCredentials{
+			ClientID:     "s5gfen1bgxz7s9i",
+			ClientSecret: "Alice123!",
+			AuthScope:    "*",
+		}
+
+		assert.Error(t, m.Validate())
+	})
+	t.Run("NoSecret", func(t *testing.T) {
+		m := ClientCredentials{
+			ClientID:     "cs5gfen1bgxz7s9i",
+			ClientSecret: "",
+			AuthScope:    "*",
+		}
+
+		assert.Error(t, m.Validate())
+	})
+	t.Run("InvalidSecret", func(t *testing.T) {
+		m := ClientCredentials{
+			ClientID:     "cs5gfen1bgxz7s9i",
+			ClientSecret: "abc  123",
+			AuthScope:    "*",
+		}
+
+		assert.Error(t, m.Validate())
+	})
+}
diff --git a/internal/form/client_test.go b/internal/form/client_test.go
index d962e5240..34d024cab 100644
--- a/internal/form/client_test.go
+++ b/internal/form/client_test.go
@@ -13,5 +13,6 @@ func TestNewClient(t *testing.T) {
 		client := NewClient()
 		assert.Equal(t, authn.MethodOAuth2, client.Method())
 		assert.Equal(t, "", client.Scope())
+		assert.Equal(t, "", client.Name())
 	})
 }
diff --git a/internal/form/client_token_test.go b/internal/form/client_token_test.go
new file mode 100644
index 000000000..e3f67ba34
--- /dev/null
+++ b/internal/form/client_token_test.go
@@ -0,0 +1,62 @@
+package form
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClientToken_Empty(t *testing.T) {
+	t.Run("AuthTokenAndTypeHintEmpty", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "",
+			TypeHint:  "",
+		}
+		assert.True(t, m.Empty())
+	})
+	t.Run("AuthTokenNotEmpty", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "abc",
+			TypeHint:  "",
+		}
+		assert.False(t, m.Empty())
+	})
+	t.Run("TypeHintNotEmpty", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "",
+			TypeHint:  "test",
+		}
+		assert.False(t, m.Empty())
+	})
+}
+
+func TestClientToken_Validate(t *testing.T) {
+	t.Run("AuthTokenEmpty", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "",
+			TypeHint:  "test",
+		}
+		assert.Error(t, m.Validate())
+	})
+	t.Run("AuthTokenInvalid", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "abc   234",
+			TypeHint:  "test",
+		}
+		assert.Error(t, m.Validate())
+	})
+	t.Run("UnsupportedToken", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "abc234",
+			TypeHint:  "test",
+		}
+		assert.Error(t, m.Validate())
+	})
+	t.Run("Valid", func(t *testing.T) {
+		m := ClientToken{
+			AuthToken: "abc234",
+			TypeHint:  "access_token",
+		}
+		assert.NoError(t, m.Validate())
+	})
+}