Hi,
My use case is supporting Native Apps to talk to oAuth endpoints.
My research indicates that in such cases the recommended approach is not to use the client secret in a Basic Authorization Header when talking to the /token endpoint.
Instead to use a onetime code verifier and code challenge - known as the PKCE extension - through the flow.
My experience with Apigee is that the oAuthV2 policy does not work if there is no Basic Authorization header that has the base64(client_id:client_secret) when performing the GenerateToken / RefreshToken operations.
Can this restriction be turned off somehow?
LinkedIn
Twitter
