Values of token_endpoint_auth_method (RFC 7591), which indicate how the client identifies itself at token_endpoint.
| Name | HTTP POST client_id |
Description |
|---|---|---|
| none | REQUIRED | No authentication. |
| client_secret_post | REQUIRED | Sending client_id and client_secret. |
| client_secret_basic | ABSENT (extract from header) | Sending the Authorization header with type Basic. |
| client_secret_jwt | ABSENT (extact from JWT) | Sending client_assertion with JWT and client_assertion_type with value urn:ietf:params:oauth:client-assertion-type:jwt-bearer. |
| private_key_jwt | ABSENT (extact from JWT) | Sending client_assertion with JWT and client_assertion_type with value urn:ietf:params:oauth:client-assertion-type:jwt-bearer. |
| tls_client_auth | REQUIRED | Using client certificate. |
| self_signed_tls_client_auth | REQUIRED | Using client certificate (self-signed). |
Public clients use none and are expected to always send client_id, confidential clients should use one of the other methods.