Aaron Parecki

Regular OAuth 2.0 also supports the Authorization Code flow with no secret. In fact, many companies recommend Auth Code w/no secret instead of Implicit.

IndieAuth is like taking Auth Code w/no secret and adding back some layers of security because of the client ID being a URL.

But, most importantly, the fact that IndieAuth uses a URL for the client ID means that you *do* authenticate the client in the initial Auth Code request, since the redirect URL has to match the domain or be registered. That's an improvement over OAuth with no secret.

Without the secret, there is no authentication of the client. PKCE solves this by using essentially an on-the-fly secret safe for use by mobile apps. IndieAuth *could* adopt the PKCE extension as well, tho afaik noone has done that yet.

Good question! The OAuth Authorization Code flow doesn't require a secret either. For example mobile apps can't use a secret, but still use the Auth Code flow. There are many benefits to the Auth Code flow over Implicit, I wrote some about that here https://developer.okta.com/blog/2018/05/24/what-is-the-oauth2-implicit-grant-type#when-to-use-the-implicit-grant-type

it also thickens hot sauce nicely

https://aaronparecki.com/2018/08/05/14/