AuthType OAuth2.0 Client Secret is always required

Ask the Experts and Postman Tips
, , ,
5

@redeyeddog

Looking into this a bit further.

Single-Page Apps - OAuth 2.0 Simplified

This flow doesn’t require the client secret as you quite rightly pointed out in your original post.

If you select “Authorization Code (with PKCE)”. I can see that it still has the field for the client_secret, but is it mandatory? If you don’t enter anything in this field, does it send the request?

This looks likes its related to this topic.

Example of retrieving a token using an Entra App with a Cert - :seedling: Just Getting Started - Postman Community

I’m not sure that the Postman Authorizations are supporting this yet. Which is a bit of an issue as the Authorization_code grant type needs user interaction and the helpers deal with that aspect. You can’t mimic this in a pre-request script.