Security
Use exact URL registration and PKCE to keep browser authentication tied to your application.
Use exact URLs
- Register only origins you control.
- Register the narrowest callback paths your app needs.
- Use HTTPS in production.
- Keep development localhost/private-network URLs out of production when they are no longer needed.
Use PKCE for public clients
Single-page and browser applications cannot safely keep a client secret. PKCE binds the browser authorization request to the client that started it. Keep PKCE enabled for public clients.
Client ID versus secrets
A Client ID identifies an application and may appear in frontend code. Passwords, tokens, server credentials and private keys are different: keep them out of browser bundles and source control.
Was this page useful?