Current Recommendation for SPA

Hi @dedicatedmanagers,

Sorry for the confusion here. I agree there is some wording there that is ambiguous.

Let’s clear this up:

Former guidance was to use the Authorization Code Flow with Proof Key for Code Exchange (PKCE) in conjunction with Silent Authentication in SPAs

The former/current guidance has to do with Silent Authentication VS Refresh Token Rotation (RTR). The Auth Code + PKCE flow is used to request tokens in either instance, so that should not be the focus of that sentence.

RTR is the current guidace.

I added a PR that should clarify that doc.