A 400 Bad Request is returned from the server when the request is forbidden. The most common issue for the 400 Bad Request error is an unauthenticated request.
Unauthenticated requests are something that is outside of the WP OAuth Server plugin and has to do with the API request and not being authorized.
- Check the username and password if you are using basic authentication
- Ensure that the access token being used is valid and being sent in a manner that the server recognizes it.