I’ve successfully integrated my React application with Okta! However, I have a question regarding security best practices. Specifically, I’m wondering what the best approach is for keeping the client ID confidential and protect it from user access?
client_id is not considered a secret as it will be visible in the browsers network tab during an /authorize call.
Thank you @erik.
I was reading the Authorization Code flow for web and native client types of GitHub - okta/okta-auth-js: The official js wrapper around Okta's auth API and and I saw this:
Web and native clients can obtain tokens using the
authorization_code flow which uses a client secret stored in a secure location
I thought that client_id is considered a secret.
client_id and client_secret are separate.
- Public Apps (SPA / FE / Native) won’t have a client_secret, instead they will use PKCE
- Private Apps (Web) will make use of a client_secret since they can securely store it.
Thanks for your clarification.