Combining the flows

One client, two access tokens. It uses its own token for background work, and the signed-in user's token for work done on that user's behalf.

Client credentials

The client's own token, asked for directly. No user involved, so it is available whether or not anyone is signed in.