Updated
Allow confidential clients to omit PKCE for OAuth 2.0 compatibility.
Changelog » Change #4505
This does require redirect_uri be specified in the token request when PKCE is omitted.
Comments for 2025-08-26