Hello, We have an SPA with auth0 and we are in the process of switching to OIDC. When I make an SPA an auth0 OIDC compliant there is no longer a credentials tab (as expected) but there is still a client secret. What exactly is this secret for? Before it seems it was required to validate the jwt tok…

Hi @crutten Welcome to the Auth0 Community! You are correct in this observation, as client secrets should not be used with public clients that cannot securely store secrets such as SPAs . I does not serve a major role as compared to other application types that can store secrets securely, and it wo…

What use is the client secret of an OIDC compliant SPA

Get Help

system Closed May 28, 2025, 5:58pm 4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Storing client secret in SPA Get Help security , client-secret	2	12452	August 30, 2019
What is the purpose of a client secret? Get Help auth0 , client-secret	12	7705	April 27, 2022
Auth0 ClientID visible in chrome dev tools request header Get Help jwt , auth0js	2	4348	September 15, 2020
Auth Code + PKCE. Secret VS No Secret? Get Help jwt , auth0 , pkce	5	4914	April 14, 2021
Best deployment practice for securing ClientID and Secret Get Help auth0 , deployment , management-api	3	3898	April 13, 2019

What use is the client secret of an OIDC compliant SPA

Related topics