[PHP] Resource Owner Password Flow, clientID and clientSecret

I am curious to understand how to represent resource owner password in swagger.
My understanding is that resource owner password you must send in the client secret and client id base-64 encoded.
For example: https://developers.getbase.com/docs/rest/articles/oauth2/requests
The request is sent as follows:

Authorization: Basic Base64($CLIENT_ID:$CLIENT_SECRET)

$ curl -v -X GET https://api.getbase.com/oauth2/token \
       -u "$CLIENT_ID:$CLIENT_SECRET" \
       -d "grant_type=password" \
       -d "username=$USERNAME" \
       -d "password=$PASSWORD"

However swagger-codegen seems to have no mention about client Id and client secret.
This is how I am representing password flow in the swagger

securityDefinitions:
  auth:
    type: oauth2
    flow: password
    tokenUrl: 'https://api.getbase.com/oauth2/token'
    scopes: {}

The resultant php clients are initialized like so:

    $result = $api_instance->createAnAuthenticationToken($grant_type, $username, $password);

Where is the client id and client secret? Have I misunderstood the password flowtype?

Start with the securityDefinitions password-flow configuration and the generated PHP createAnAuthenticationToken entry point shown in the issue. Trace how the generator handles client credentials for this flow and compare that behavior with the documented request format. Done means the supported behavior and generated client interface are consistent, or the limitation is explicitly documented.