An incorrect Issuer in the payload of the client_secret can cause an "invalid_client" response. So check your Issuer value, as well. It should be the 10-character Team ID associated with your developer account.