---
title: OIDC client authentication
description: Configure OIDC client authentication methods including client secrets, JWT, and mutual TLS in PingAM
component: pingam
version: 8
page_id: pingam:am-oidc1:oidc-client-auth
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oidc1/oidc-client-auth.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-07-20T20:16:41Z
keywords: ["OpenID Connect (OIDC)", "Standards", "Setup & Configuration", "Integration"]
page_aliases: ["oidc1-guide:oidc-client-auth.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-oidc1/oidc-client-auth.html
---

# OIDC client authentication

OIDC clients can use the authentication methods described in [OAuth 2.0 client authentication](../am-oauth2/oauth2-client-auth.html). Set the authentication method in the client profile:

1. In the AM admin UI, go to Realms > *realm name* > Applications > OAuth 2.0 > Clients > *client ID*.

2. On the Advanced tab, select the method from the Token Endpoint Authentication Method list:

   | Method                          | Description                                                                                                                                                                                                                                                                                                                                                                                  |
   | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | `client_secret_basic` (default) | The client sends its credentials in an HTTP Basic `Authorization` header.                                                                                                                                                                                                                                                                                                                    |
   | `client_secret_post`            | The client sends its credentials as `client_id` and `client_secret` form parameters.When a client authenticates with form parameters, the server can store POST data on the user-agent in an `OAUTH_REQUEST_ATTRIBUTES` cookie. AM uses the cookie to continue the authentication process across redirects. It marks the cookie for deletion on the next successful OAuth 2.0 authorization. |
   | `none`                          | The client is public and doesn't authenticate.Public clients don't authenticate even if the authentication method is different from `none`.                                                                                                                                                                                                                                                  |
   | `private_key_jwt`               | The client sends its credentials as a JSON Web Token (JWT).                                                                                                                                                                                                                                                                                                                                  |
   | `self_signed_tls_client_auth`   | The client uses a self-signed certificate for mutual TLS authentication.                                                                                                                                                                                                                                                                                                                     |
   | `tls_client_auth`               | The client uses a CA-signed certificate for mutual TLS authentication.                                                                                                                                                                                                                                                                                                                       |

3. Click Save Changes.