diff --git a/README.md b/README.md
index 1bf6ba2e08612dc5f17340afafeabdd56549e6c9..7a1f2b038a7ac97999310458f16221c1656f572c 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,9 @@ String scope = "write"; // write scope is required to manage data on Genesys
 GenesysClient genesysClient = new GenesysClient(baseUrl, clientId, clientSecret, callbackUrl, scope);
 ```
 
-### Authentication
+### Authentication: Authorization code
+
+For Genesys API clients that support `authorization_code` grant (such as websites, unsafe clients).
 
 ```java
 // Authenticate the user
@@ -32,10 +34,27 @@ genesysClient.me();
 // genesysClient.getTokens().getRefreshToken();
 ```
 
+### Authentication: Username and password
+
+For Genesys API clients that support `password` grant (safe clients).
+
+```java
+// Obtain username and password
+String username;
+String password;
+genesysClient.authenticate(username, password);
+
+// Test it with /me
+genesysClient.me();
+
+// Tokens are now accessible. The refreshToken must be **safely** stored for future use.
+// genesysClient.getTokens().getAccessToken();
+// genesysClient.getTokens().getRefreshToken();
+```
+
 ### Re-using tokens
 
-If you have existing tokens you can provide the access and refresh tokens when
-initializing the client:
+If you have existing tokens you can provide the access and refresh tokens when initializing the client:
 
 ```java
 GenesysTokens genesysTokens = new GenesysTokens();
@@ -71,9 +90,9 @@ try {
 
 ```xml
 <dependency>
-	<groupId>org.genesys-pgr</groupId>
-	<artifactId>genesys-client-api</artifactId>
-	<version>1.2</version>
+    <groupId>org.genesys-pgr</groupId>
+    <artifactId>genesys-client-api</artifactId>
+    <version>1.2</version>
 </dependency>
 ```
 
@@ -81,9 +100,9 @@ Or for the development version:
 
 ```xml
 <dependency>
-	<groupId>org.genesys-pgr</groupId>
-	<artifactId>genesys-client-api</artifactId>
-	<version>1.3-SNAPSHOT</version>
+    <groupId>org.genesys-pgr</groupId>
+    <artifactId>genesys-client-api</artifactId>
+    <version>1.3-SNAPSHOT</version>
 </dependency>
 ```
 
diff --git a/src/main/java/org/genesys2/client/oauth/GenesysClient.java b/src/main/java/org/genesys2/client/oauth/GenesysClient.java
index dcff217f5be36ff4cbf92b6fa96a48385a5fbfcb..5fa0f843434e95e875007fa7219318f2852900cf 100644
--- a/src/main/java/org/genesys2/client/oauth/GenesysClient.java
+++ b/src/main/java/org/genesys2/client/oauth/GenesysClient.java
@@ -116,7 +116,7 @@ public class GenesysClient {
 	public String getAuthorizationUrl() {
 		return service.getAuthorizationUrl();
 	}
-	
+
 	/**
 	 * Sets the tokens.
 	 *
@@ -231,7 +231,7 @@ public class GenesysClient {
 				request.setPayload(postBody);
 			}
 
-			request.setCharset("UTF-8");			
+			request.setCharset("UTF-8");
 			Response response = null;
 
 			try {
@@ -540,16 +540,34 @@ public class GenesysClient {
 		return query(Verb.POST, "/acn/" + instCode + "/delete", null, jsonAccessionIdList);
 	}
 
+	public void authenticate(String uname, String password) throws OAuthAuthenticationException {
+		try {
+			OAuth2AccessToken accessToken = service.getAccessTokenPasswordGrant(uname, password);
+
+			LOG.info("ACCESS TOKEN: {} scope={} raw={}", accessToken.getAccessToken(), accessToken.getScope(), accessToken.getRawResponse());
+
+			final String refreshToken = accessToken.getRefreshToken();
+			LOG.info("REFRESH TOKEN: {}", refreshToken);
+
+			tokens.setAccessToken(accessToken.getAccessToken());
+			tokens.setRefreshToken(refreshToken);
+
+		} catch (IOException | InterruptedException | ExecutionException e) {
+			LOG.error("Auth error", e);
+			throw new OAuthAuthenticationException(e.getMessage());
+		}
+	}
+
 	/**
 	 * Obtain access and refresh tokens with verifier code.
 	 *
 	 * @param verifierCode the verifier code
-	 * @throws OAuthAuthenticationException 
+	 * @throws OAuthAuthenticationException
 	 */
 	public void authenticate(final String verifierCode) throws OAuthAuthenticationException {
 		try {
 			OAuth2AccessToken accessToken = service.getAccessToken(verifierCode);
-			
+
 			LOG.info("ACCESS TOKEN: {} scope={} raw={}", accessToken.getAccessToken(), accessToken.getScope(), accessToken.getRawResponse());
 
 			final String refreshToken = accessToken.getRefreshToken();