You find your client id and secret here: https://podio.com/settings/api
You control how you authenticate. When you call Podio::authenticate you specify the authentication type. If you call that method multiple times the last one counts. If you get the error that you are getting you are indeed authenticated as an app and not a user.