The problem with the Password Credentials Grant is the credentials are relayed in plaintext. Not a problem per se, if the backend is closed (serverside), but that defeats the purpose of your client authentication method.
OAuth can be used to prove object authentication, but you may not use OAuth for that. The better way would be to use Authentication Code Grant, and send the user to a login page on the OAuth provider via a webview. First time the user can decide to accept or decline the OAuth client. After that the client (your app) can talk to the API using the bearer access token. If the OAuth provider associates the access token with the authentication object (I recommend this) the API is always capable of checking the authentication state.
For more fancy authentication you should really consider JWT. JWT and OAuth play nice together and take the best of both.