I may be able to help here.
For the authorization part, your API keys must have "Resource Owner Password" permissions
grant_type will be "password"
Your authorization request will need to look like the following:
grant_type: password
username: <Cisc...
I went through all this pain in the hope it would generate a sessionalised URL I could download directly from my Cisco router with;
copy http://<uniquecloudurl> flash:xxxxxx.bin
It doesn't appear that is the case as the request to download the image ...