If the client was issued a secret, the client must pass its client_id and client_secret in the authorization header through Basic HTTP authorization. The secret is Basic Base64Encode(client_id:client_secret).
Last I checked, this wasn't standard, but it's also possible I'm completely misremembering the RFC.
Are there any plans to support this in the library? I can write a PR if needed.
jtroussard
commented
3 years ago
Hello,
I just had a quick question. Are there any plans to provide support for Amazon Cognito?
They have an "oddity" with how they accept the client ID & secret on the TOKEN route: https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html
Last I checked, this wasn't standard, but it's also possible I'm completely misremembering the RFC.
Are there any plans to support this in the library? I can write a PR if needed.
Thanks!