From ea2e6656039415e2623623a1d28f60155a76a201 Mon Sep 17 00:00:00 2001 From: sukujgrg Date: Mon, 17 Aug 2026 06:22:40 +1000 Subject: [PATCH] Note that Google Desktop still posts a client secret at the token endpoint. Co-authored-by: Cursor --- skills/oauth2c/reference.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/skills/oauth2c/reference.md b/skills/oauth2c/reference.md index d302755..b3ceb82 100644 --- a/skills/oauth2c/reference.md +++ b/skills/oauth2c/reference.md @@ -65,7 +65,10 @@ usable at `/userinfo`. or `http://[::1]`. The `redirect_uri` in authorize and token must still include the port the app actually bound. oauth2c does not bind `:0` and rewrite `redirect_uri`; use a fixed port. To see any-port policy, run -two fixed ports. Google Web clients are exact-match, like Auth0. +two fixed ports. Google issues a `client_secret` for Desktop apps; send +it on the token request with `--auth-method client_secret_post`. PKCE +does not replace that. Do not use the skill’s public recipe +(`--auth-method none`). Google Web clients are exact-match, like Auth0. ## Auth0 demo env