tokenEndpointAuthMethod

Client authentication method for token endpoint requests: authorization code exchange and token refresh.

When null (default), the method is selected from OpenIdProviderMetadata.tokenEndpointAuthMethodsSupported:

• ClientAuthenticationMethod.ClientSecretPost when the metadata lists client_secret_post as supported, and when the metadata does not declare supported methods at all.

• ClientAuthenticationMethod.ClientSecretBasic when the metadata declares supported methods and client_secret_post is not among them.

Set explicitly when your client registration requires a specific method — discovery metadata describes the provider's capabilities, not what this client was registered to use — or when provider metadata is inaccurate.

Report a problem