---
title: Changing the default OIDC grant type
description: Change the Delegated Admin default OpenID Connect grant type to Authorization Code with PKCE to hide access tokens during authentication.
component: pingdirectory
version: 11.1
page_id: pingdirectory:delegated_admin_application_guide:pd_da_change_oidc_grant_type
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/delegated_admin_application_guide/pd_da_change_oidc_grant_type.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 22, 2023
section_ids:
  steps: Steps
  example: Example:
---

# Changing the default OIDC grant type

To change the Delegated Admin application's default OpenID Connect (OIDC) grant type, use the PingFederate admin console and the Delegated Admin `config.js` file.

To improve authentication security, switch your default OIDC grant type to **Authorization Code** with **Require Proof Key for Code Exchange (PKCE)**. The Authorization Code with PKCE grant type hides access tokens during authentication with JavaScript applications. In comparison, the Implicit grant type displays access tokens in the URL redirect during OIDC authentication.

|   |                                                                                                                                                                                                                                                       |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | We deprecated support for the Implicit grant type and will remove it in a future release. Use the Authorization Code with PKCE grant type instead. Learn more about [OAuth grant types](https://oauth.net/2/grant-types/) in the OAuth documentation. |

The following example changes the default OIDC grant type from **Implicit** to **Authorization Code** with **Require Proof Key for Code Exchange (PKCE)**.

## Steps

1. In the PingFederate admin console, go to **Applications > OAuth > Clients**.

2. From the **Clients** list, select the **dadmin** client.

3. In the **Allowed Grant Types** section:

   1. Select the **Authorization Code** checkbox.

   2. Clear the **Implicit** checkbox.

   3. Select the **Require Proof Key for Code Exchange (PKCE)** checkbox.

   4. Click **Save**.

4. From your `<server-root>` directory, open the Delegated Admin application's `config.js` file and set the `AUTHENTICATE_WITH_PKCE` variable to `true`.

   ### Example:

   ```
   /*
    * Indicates if this app should authenticate using the 'Authorization Code with PKCE' OAuth grant.
    * If true, the 'Authorization Code with PKCE grant will be used. If false, the 'Implicit' grant
    * will be used. * DEFAULT: window.AUTHENTICATE_WITH_PKCE = true;
    */
   window.AUTHENTICATE_WITH_PKCE = true;
   ```

   |   |                                                                                                            |
   | - | ---------------------------------------------------------------------------------------------------------- |
   |   | If you don't already have the `AUTHENTICATE_WITH_PKCE` variable in your `config.js` file, you must add it. |