Where should a confidential municipal client use its client secret…

Question

Where should a confidential municipal client use its client secret during the authorization-code grant?

Accepted Answer

Only when authenticating the client to the token endpoint on the code exchange — The secret is the shop’s back-door key for the token counter—not a hallway badge and not something you hand to visitors. Keep it on the token hop; never ship it to the browser or slap it on as Bearer.

Answer

As the Authorization Bearer value on every protected resource GET

Answer

In the resource owner’s browser as a hidden form field during consent

Answer

Inside the authorize redirect URL query string next to responsetype=code

Where should a confidential municipal client use its client secret during the authorization-code grant?

Short Explanation

Full Explanation