# AuthType OAuth2.0 Client Secret is always required **URL:** \ **Category:** Help Hub\ **Tags:** authorization, authentication, oauth2, secret\ **Created:** [October 15, 2024, 9:04am UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721 "2024-10-15T09:04:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![redeyeddog](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@redeyeddog](https://community.postman.com/u/redeyeddog)\ **Post date:** [October 15, 2024, 9:04am UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721/1 "2024-10-15T09:04:15Z")
Hi, when using the Authorization tab with the “Auth Type=OAuth2.0” and “Grant type = Authorization Code” why am i always required to have a client\_secret… when some of these flows don’t require it? what am i doing wrong, is this postman enforcing this requirement or am i misunderstanding something . An SPA can use the Authorization code flow and does not require a client secret as its insecure. Thanks ---
**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\ **Post date:** [October 15, 2024, 12:11pm UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721/2 "2024-10-15T12:11:19Z")
The Authorization helper is performing multiple actions to mimic the authorization\_code authentication flow. The first action is to hit the authorization end point and retrieve an authorization code. This action requires the client\_id but doesn’t require the client\_secret. The second action is to exchange the authorization code for an access token. This part is sent with the “authorization\_code” grant type. This does require the client\_id and matching client\_secret. > **[Authorization Code Grant - OAuth 2.0 Simplified](https://www.oauth.com/oauth2-servers/server-side-apps/authorization-code)** > > The authorization code is a temporary code that the client will exchange for an access token. The code itself is obtained from the authorization server From the documentation. > ##### Client Authentication (required) > > The service will require the client authenticate itself when making the request for an access token. Typically services support client authentication via HTTP Basic Auth with the client’s `client_id` and `client_secret`. However, some services support authentication by accepting the `client_id` and `client_secret` as POST body parameters. Check the service’s documentation to find out what the service expects, since the OAuth 2.0 spec leaves this decision up to the service. Postman supports both of these options. ![image](https://us1.discourse-cdn.com/getpostman/original/3X/b/b/bb37bdd737e753e16c2ec3e64a854c12ff03cb24.png) ---
**Author:** ![redeyeddog](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@redeyeddog](https://community.postman.com/u/redeyeddog)\ **Post date:** [October 16, 2024, 8:06am UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721/3 "2024-10-16T08:06:53Z")
Hi thanks for the reply. How would that work for Public clients then who do not have a client\_secret? i think they use “Grant type = Authorization Code”. ---
**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\ **Post date:** [October 16, 2024, 4:24pm UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721/4 "2024-10-16T16:24:24Z")
Define what you mean by a “Public client”. I can only suggest checking the OAuth 2.0 standard. As far as I’m aware, the OAuth 2.0 standard for the Authorization\_code grant type requires you to send the client\_secret alongside the client\_id. This is where you exchange the authorization code that you got in the previous step for an access token. I guess the challenge I would put back to do is to show in the standard where it states that the client\_secret is optional or not needed. The link I provided you with is an abridged version of the standard, but it is showing that the client\_secret is “required”. More relevant info from that link… > The authorization code flow offers a few benefits over the other grant types. When the user authorizes the application, they are redirected back to the application with a temporary code in the URL. The application exchanges that code for the access token. When the application makes the request for the access token, that request can be authenticated with the client secret, which reduces the risk of an attacker intercepting the authorization code and using it themselves. This also means the access token is never visible to the user or their browser, so it is the most secure way to pass the token back to the application, reducing the risk of the token leaking to someone else. ---
**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\ **Post date:** [October 17, 2024, 12:33pm UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721/5 "2024-10-17T12:33:13Z")
@redeyeddog Looking into this a bit further. [Single-Page Apps - OAuth 2.0 Simplified](https://www.oauth.com/oauth2-servers/single-page-apps/) This flow doesn’t require the client secret as you quite rightly pointed out in your original post. If you select “Authorization Code (with PKCE)”. I can see that it still has the field for the client\_secret, but is it mandatory? If you don’t enter anything in this field, does it send the request? This looks likes its related to this topic. [Example of retrieving a token using an Entra App with a Cert - 🌱 Just Getting Started - Postman Community](https://community.postman.com/t/example-of-retrieving-a-token-using-an-entra-app-with-a-cert/69750) I’m not sure that the Postman Authorizations are supporting this yet. Which is a bit of an issue as the Authorization\_code grant type needs user interaction and the helpers deal with that aspect. You can’t mimic this in a pre-request script. ---
**Author:** ![system](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/system/32/29796_2.png) [@system](https://community.postman.com/u/system)\ **Post date:** [November 16, 2024, 12:34pm UTC](https://community.postman.com/t/authtype-oauth2-0-client-secret-is-always-required/69721/6 "2024-11-16T12:34:08Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.