Docs saying for PKCE said public to true?

[hannojg]

For the oauth flow the docs say that you need to set the public field to true to use PKCE. I think its the other way around? If you set it to "true" you don't get a client_secret, hence no PCKE?

[hannojg]

Or maybe i am misunderstanding, but when creating an OAAuth app with public: true we don't get a secret - is that a bug?

[jescalan]

Hey @hannojg - the docs are accurate at the moment, when you set it to true, it will not return a client secret and expect usage of PKCE.

We should definitely also support the scenario where you are using PKCE and also want a client secret though as it seems you are expecting, and we have a ticket internally to make that happen. I'll make sure you get an update when it has!

[hannojg]

Thanks! But there is still in an error in the docs, no? Public is set to true, but in the example response a client_secret is returned?