From 43baa2b0e3abd735e0021b8c2c9d873c4294e918 Mon Sep 17 00:00:00 2001 From: Carlos Date: Thu, 30 Jul 2026 13:48:07 +0200 Subject: [PATCH] docs(DOCS-5590): document client_secret for PKCE token exchange Adds the missing client_secret body parameter to the Authorization Code Flow with PKCE get-token page and its OAS schema, covering confidential clients that use PKCE with client_secret_post auth. --- .../authorization-code-flow-with-pkce/get-token-pkce.mdx | 4 ++++ main/docs/oas/authentication/authentication-api-oas.json | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/main/docs/api/authentication/authorization-code-flow-with-pkce/get-token-pkce.mdx b/main/docs/api/authentication/authorization-code-flow-with-pkce/get-token-pkce.mdx index bbf6fe449b..67ea346a97 100644 --- a/main/docs/api/authentication/authorization-code-flow-with-pkce/get-token-pkce.mdx +++ b/main/docs/api/authentication/authorization-code-flow-with-pkce/get-token-pkce.mdx @@ -42,6 +42,10 @@ This is the flow that mobile apps use to access an API. Use this endpoint to exc Your application's Client ID. + + The `client_secret` of your application. Required for confidential applications using the `client_secret_post` token endpoint authentication method. + + The Authorization Code received from the initial `/authorize` call. diff --git a/main/docs/oas/authentication/authentication-api-oas.json b/main/docs/oas/authentication/authentication-api-oas.json index c8be8a92ca..ae01713d9d 100644 --- a/main/docs/oas/authentication/authentication-api-oas.json +++ b/main/docs/oas/authentication/authentication-api-oas.json @@ -3600,6 +3600,10 @@ "type": "string", "description": "Your application's Client ID" }, + "client_secret": { + "type": "string", + "description": "Your application's Client Secret. Required for confidential clients." + }, "code_verifier": { "type": "string", "description": "The original code verifier for the PKCE request. The authorization server will hash this and compare it to the code_challenge from the authorization request.",