diff --git a/src/json_api/oauth/generate_token.rs b/src/json_api/oauth/generate_token.rs
index 9cd07a0..df43982 100644
--- a/src/json_api/oauth/generate_token.rs
+++ b/src/json_api/oauth/generate_token.rs
@@ -59,19 +59,25 @@ pub async fn generate_token(
     form_data: Form<TokenRequest<'_>>
 ) -> Result<Json<OAuthTokenResponse>, (Status, Json<OAuthErrorResponse>)> {
     
-    if form_data.client_id != Some("account") {
-        return Err((
-            Status::BadRequest,
-            Json(OAuthErrorResponse { error: "invalid_client".to_string() })
-        ));
-    }
-
-    let cl_secret: String = CLIENT_SECRET.clone();
-    if form_data.client_secret != Some(&cl_secret) {
-        return Err((
-            Status::Unauthorized,
-            Json(OAuthErrorResponse { error: "invalid_client".to_string() })
-        ));
+    match form_data.client_id {
+        Some("account") | Some("splatnet") => {
+            let cl_secret: String = CLIENT_SECRET.clone();
+            if form_data.client_secret != Some(&cl_secret) {
+                return Err((
+                    Status::Unauthorized,
+                    Json(OAuthErrorResponse { error: "invalid_client".to_string() })
+                ));
+            }
+        }
+        Some("website") => {
+            // no secret for this client, cant be kept confidential in the case of the website
+        }
+        _ => {
+            return Err((
+                Status::BadRequest,
+                Json(OAuthErrorResponse { error: "invalid_client".to_string() })
+            ));
+        }
     }
 
     // i'm only supporting the password grant incase someone feels lazy.
@@ -163,4 +169,4 @@ pub async fn generate_token(
         token_type: "Bearer".to_string(),
         expires_in: 3600,
     }))
-}
\ No newline at end of file
+}