The user_id is a unique field per client. You can call Clients::getByUserId() to fetch the client.
Something like the below may be what you're looking for:
<?php
...
$user = $api->get("users", "getByUsername", array('username' => $_GET['username']))->response();
if ($user) {
$password_matches = $api->get("users", "checkPassword", array('password' => $_GET['password'], 'stored_hash' => $user->password))->response();
$client = $api->get("clients", "getByUserId", array('user_id' => $user->id))->response();
if ($password_matches && $client) {
$api->post("clients", "setCustomField", array('field_id' => 5, 'client_id' => $client->id, 'value' => "my_new_value"));
}
}
...
?>