Looking for a simple answer to this. SPAs and Clients with a back-end clients can both use Auth Code + PKCE. However, clients with a back-end use secrets (SPAs can’t be trusted to keep one). The official spec for Auth Code + PKCE says nothing about secrets and if/when they are required, unless I mi…

Currently, the PKCE flow is only supported with public clients (native/SPA) within Auth0. If this is something that you’d like to see supported, I’d recommend providing your use case in a feature request in the Feedback category: Feedback - Auth0 Community Thank you!

Auth Code + PKCE. Secret VS No Secret?

Get Help

system Closed April 29, 2021, 11:19am 7

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How does Auth0 provide authorization code flow in a SPA Get Help	6	4989	May 9, 2020
Is it possible to use PKCE authorization code flow for regular web app? Get Help configuration , application	2	2725	March 14, 2023
Authorization code flow without client-secret? Get Help code	5	13561	December 6, 2019
PKCE support for SPA Get Help spa , pkce , authorization-code	7	5944	February 15, 2019
How to authenticate SPA against API without User login Get Help	4	3931	November 22, 2019

Auth Code + PKCE. Secret VS No Secret?

Related topics