Configuring an OAuth 2.1-compliant client

You can configure an OAuth client in PingFederate that complies with the developing OAuth 2.1 framework.

Learn more about the major changes in OAuth 2.1 in the OAuth documentation and the OAuth 2.1 specifications.

The following table compares the changes in OAuth versions as they apply to PingFederate clients:

Feature	OAuth 2.0	OAuth 2.1
Proof Key for Code Exchange (PKCE)	Optional. Mostly used for mobile or single page applications	Mandatory for all clients that use the authorization code grant type
Implicit Grant	Allowed but discouraged	Deprecated
Resource Owner Password Credentials (ROPC) Grant	Allowed using username and password authentication	Deprecated
Redirect URIs	Partial string matches allowed	Exact string matches required
Refresh Tokens	No strict user requirements for web authentication	Must be Sender-Constrained or use rotation

Feature

OAuth 2.0

OAuth 2.1

Proof Key for Code Exchange (PKCE)

Optional. Mostly used for mobile or single page applications

Mandatory for all clients that use the authorization code grant type

Implicit Grant

Allowed but discouraged

Deprecated

Resource Owner Password Credentials (ROPC) Grant

Allowed using username and password authentication

Deprecated

Redirect URIs

Partial string matches allowed

Exact string matches required

Refresh Tokens

No strict user requirements for web authentication

Must be Sender-Constrained or use rotation