--- a/mod_http_oauth2/mod_http_oauth2.lua	Tue Mar 07 15:31:19 2023 +0000
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Tue Mar 07 15:33:07 2023 +0000
@@ -466,7 +466,7 @@
 		return error_response(event.request, oauth_error("invalid_request"));
 	end
 
-	if credentials.type == "basic" then
+	if credentials and credentials.type == "basic" then
 		params.client_id = http.urldecode(credentials.username);
 		params.client_secret = http.urldecode(credentials.password);
 	end