Oauth2 is a cluster; you can "follow the spec" and still get incompatible implementations... by design.

I'm not sure what the original intent was here; the OAUTH2 spec explicitly states that the format of the token itself is out of scope yet in this case sending that may help with auth in some way; Still, if it's not used it shouldn't be sent.

Does removing this break any of the big examples?

Sorry to disappoint but I have absolutely no idea... I only started using oauthlib a few days ago in my specific scenario at work.

I'm not sure how the client_id would be used by the server as it already gets it from HTTP basic authentication.

Do you have a test suite that I could run to help speed things up on this matter? In any case, the unused parameter should be used instead of self.client_id.

Just realized that the doc of this function is wrong but also doctests:

>>> from oauthlib.oauth2 import WebApplicationClient
>>> client = WebApplicationClient('your_id')
>>> client.prepare_request_body(code='sh35ksdf09sf')
'grant_type=authorization_code&code=sh35ksdf09sf'
>>> client.prepare_request_body(code='sh35ksdf09sf', foo='bar')
'grant_type=authorization_code&code=sh35ksdf09sf&foo=bar'

Here is when I run it:

>>> from oauthlib.oauth2 import WebApplicationClient
>>> client = WebApplicationClient('your_id')
>>> client.prepare_request_body(code='sh35ksdf09sf')
'grant_type=authorization_code&client_id=your_id&code=sh35ksdf09sf'
>>> client.prepare_request_body(code='sh35ksdf09sf', foo='bar')
'grant_type=authorization_code&client_id=your_id&foo=bar&code=sh35ksdf09sf'

When you modify that:

Do the tests run successfully and all pass?
What is the change in test coverage?

It only failed on test_request_body which is to be expected.