coder · BobbyHo · Sep 1, 2026 · Aug 10, 2026 · Aug 10, 2026 · Aug 10, 2026
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/oauth2.go b/coderd/oauth2.go
@@ -95,6 +95,7 @@ func (api *API) oAuth2ProviderAppSecrets() http.HandlerFunc {
 // @Tags Enterprise
 // @Param app path string true "App ID"
 // @Success 200 {array} codersdk.OAuth2ProviderAppSecretFull
+// @Failure 400 {object} codersdk.Response "Public clients cannot have secrets"
 // @Router /api/v2/oauth2-provider/apps/{app}/secrets [post]
 func (api *API) postOAuth2ProviderAppSecret() http.HandlerFunc {
 	return oauth2provider.CreateAppSecret(api.Database, api.Auditor.Load(), api.Logger)

diff --git a/coderd/oauth2_test.go b/coderd/oauth2_test.go
@@ -150,6 +150,31 @@ func TestOAuth2ProviderAppSecrets(t *testing.T) {
 		_, err = client.OAuth2ProviderAppSecrets(ctx, apps.Default.ID)
 		require.Error(t, err)
 	})
+
+	t.Run("RejectsPublicClient", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		oauth2providertest.EnableDCR(t, client)
+		app := oauth2providertest.RegisterPublicClient(t, client, "app-secrets-public", "http://localhost:8080/callback")
+		appID, err := uuid.Parse(app.ClientID)
+		require.NoError(t, err)
+
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		_, err = client.PostOAuth2ProviderAppSecret(ctx, appID)
+		// Check the status and message, since a bare require.Error would also
+		// pass for a request that never reached the guard.
+		var sdkError *codersdk.Error
+		require.ErrorAsf(t, err, &sdkError, "error should be of type *codersdk.Error")
+		require.Equal(t, http.StatusBadRequest, sdkError.StatusCode())
+		require.Contains(t, sdkError.Message, "public OAuth2 app")
+
+		// No partial secret was created.
+		//nolint:gocritic // OAuth2 app management requires owner permission.
+		secrets, err := client.OAuth2ProviderAppSecrets(ctx, appID)
+		require.NoError(t, err)
+		require.Empty(t, secrets)
+	})
 }
 
 func TestOAuth2ProviderTokenExchange(t *testing.T) {

diff --git a/coderd/oauth2provider/app_secrets.go b/coderd/oauth2provider/app_secrets.go
@@ -53,6 +53,18 @@ func CreateAppSecret(db database.Store, auditor *audit.Auditor, logger slog.Logg
 			})
 		)
 		defer commitAudit()
+
+		// A secret here would do nothing. The token endpoint does not check
+		// it, and deleting it revokes no tokens, because a public client's
+		// tokens have a NULL app_secret_id.
+		if app.IsPublic() {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Cannot create a client secret for a public OAuth2 app.",
+				Detail:  "Public clients authenticate with PKCE and have no client secret. The client type is fixed at registration, so register a new confidential client instead.",
+			})
+			return
+		}
+
 		secret, err := GenerateSecret()
 		if err != nil {
 			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

diff --git a/coderd/oauth2provider/registration.go b/coderd/oauth2provider/registration.go
@@ -199,7 +199,7 @@ func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, audi
 			SoftwareVersion:         app.SoftwareVersion.String,
 			GrantTypes:              slice.StringEnums[codersdk.OAuth2ProviderGrantType](app.GrantTypes),
 			ResponseTypes:           slice.StringEnums[codersdk.OAuth2ProviderResponseType](app.ResponseTypes),
-			TokenEndpointAuthMethod: codersdk.OAuth2TokenEndpointAuthMethod(app.TokenEndpointAuthMethod.String),
+			TokenEndpointAuthMethod: reportedAuthMethod(app),
 			Scope:                   app.Scope.String,
 			Contacts:                app.Contacts,
 			RegistrationAccessToken: registrationToken,
@@ -262,7 +262,7 @@ func GetClientConfiguration(db database.Store) http.HandlerFunc {
 			SoftwareVersion:         app.SoftwareVersion.String,
 			GrantTypes:              slice.StringEnums[codersdk.OAuth2ProviderGrantType](app.GrantTypes),
 			ResponseTypes:           slice.StringEnums[codersdk.OAuth2ProviderResponseType](app.ResponseTypes),
-			TokenEndpointAuthMethod: codersdk.OAuth2TokenEndpointAuthMethod(app.TokenEndpointAuthMethod.String),
+			TokenEndpointAuthMethod: reportedAuthMethod(app),
 			Scope:                   app.Scope.String,
 			Contacts:                app.Contacts,
 			RegistrationAccessToken: "", // RFC 7592: Not returned in GET responses for security
@@ -418,7 +418,7 @@ func UpdateClientConfiguration(db database.Store, auditor *audit.Auditor, logger
 			SoftwareVersion:         updatedApp.SoftwareVersion.String,
 			GrantTypes:              slice.StringEnums[codersdk.OAuth2ProviderGrantType](updatedApp.GrantTypes),
 			ResponseTypes:           slice.StringEnums[codersdk.OAuth2ProviderResponseType](updatedApp.ResponseTypes),
-			TokenEndpointAuthMethod: codersdk.OAuth2TokenEndpointAuthMethod(updatedApp.TokenEndpointAuthMethod.String),
+			TokenEndpointAuthMethod: reportedAuthMethod(updatedApp),
 			Scope:                   updatedApp.Scope.String,
 			Contacts:                updatedApp.Contacts,
 			RegistrationAccessToken: "", // RFC 7592: Not returned for security
@@ -570,6 +570,25 @@ func RequireRegistrationAccessToken(db database.Store) func(http.Handler) http.H
 
 // Helper functions for RFC 7591 Dynamic Client Registration
 
+// reportedAuthMethod returns the token_endpoint_auth_method to report for an
+// app: the stored value, unless it disagrees with the client type.
+//
+// Clients registered before Coder derived the type from the method can be
+// stored as confidential with a method of "none". Reporting "none" would tell
+// such a client to stop sending the secret its token exchange still requires.
+// A client that sends the reported value back on its next update fixes the row.
+func reportedAuthMethod(app database.OAuth2ProviderApp) codersdk.OAuth2TokenEndpointAuthMethod {
+	stored := codersdk.OAuth2TokenEndpointAuthMethod(app.TokenEndpointAuthMethod.String)
+	if stored.Valid() && (stored == codersdk.OAuth2TokenEndpointAuthMethodNone) == app.IsPublic() {
+		return stored
+	}
+	if app.IsPublic() {
+		return codersdk.OAuth2TokenEndpointAuthMethodNone
+	}
+	// RFC 7591 §2 default for a client with a secret.
+	return codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic
+}
+
 // generateClientCredentials generates a client secret for OAuth2 apps
 func generateClientCredentials() (plaintext string, hashed []byte, err error) {
 	// Use the same pattern as existing OAuth2 app secrets

diff --git a/coderd/oauth2provider/registration_test.go b/coderd/oauth2provider/registration_test.go
@@ -665,3 +665,129 @@ func TestUpdateClientConfiguration_LegacyAuthMethodMismatch(t *testing.T) {
 		})
 	}
 }
+
+func TestClientConfiguration_ReportedAuthMethod(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		clientType string
+		// An old row reads back empty whether it is NULL or an empty string.
+		stored sql.NullString
+		// Sent on the PUT. Must either match the stored method or agree with
+		// the client type, or the type-change guard rejects the update first.
+		resend codersdk.OAuth2TokenEndpointAuthMethod
+		want   codersdk.OAuth2TokenEndpointAuthMethod
+	}{
+		{
+			// A client that sends back the stored method, not the reported one.
+			name:       "ConfidentialStoringNoneResendingStored",
+			clientType: database.OAuth2ProviderAppClientTypeConfidential,
+			stored:     sql.NullString{String: string(codersdk.OAuth2TokenEndpointAuthMethodNone), Valid: true},
+			resend:     codersdk.OAuth2TokenEndpointAuthMethodNone,
+			want:       codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+		},
+		{
+			// A client that sends back what GET reported, which fixes the row.
+			name:       "ConfidentialStoringNoneResendingReported",
+			clientType: database.OAuth2ProviderAppClientTypeConfidential,
+			stored:     sql.NullString{String: string(codersdk.OAuth2TokenEndpointAuthMethodNone), Valid: true},
+			resend:     codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+			want:       codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+		},
+		{
+			name:       "PublicStoringSecretMethodResendingStored",
+			clientType: database.OAuth2ProviderAppClientTypePublic,
+			stored:     sql.NullString{String: string(codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic), Valid: true},
+			resend:     codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+			want:       codersdk.OAuth2TokenEndpointAuthMethodNone,
+		},
+		{
+			name:       "PublicStoringSecretMethodResendingReported",
+			clientType: database.OAuth2ProviderAppClientTypePublic,
+			stored:     sql.NullString{String: string(codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic), Valid: true},
+			resend:     codersdk.OAuth2TokenEndpointAuthMethodNone,
+			want:       codersdk.OAuth2TokenEndpointAuthMethodNone,
+		},
+		{
+			// RFC 7591 §2 defaults an unset method to client_secret_basic.
+			name:       "ConfidentialStoringNothing",
+			clientType: database.OAuth2ProviderAppClientTypeConfidential,
+			stored:     sql.NullString{String: "", Valid: true},
+			resend:     codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+			want:       codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+		},
+		{
+			// The stored method agrees with the type but is not the type
+			// default, so this case fails if the default is returned instead.
+			name:       "ConfidentialStoringClientSecretPost",
+			clientType: database.OAuth2ProviderAppClientTypeConfidential,
+			stored:     sql.NullString{String: string(codersdk.OAuth2TokenEndpointAuthMethodClientSecretPost), Valid: true},
+			resend:     codersdk.OAuth2TokenEndpointAuthMethodClientSecretPost,
+			want:       codersdk.OAuth2TokenEndpointAuthMethodClientSecretPost,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			db, _ := dbtestutil.NewDB(t)
+
+			// Seeded directly, since registration derives the type from the
+			// method and can no longer create a disagreeing row.
+			app := dbgen.OAuth2ProviderApp(t, db, database.OAuth2ProviderApp{
+				CallbackURL:             "https://example.com/callback",
+				RedirectUris:            []string{"https://example.com/callback"},
+				ClientType:              tt.clientType,
+				TokenEndpointAuthMethod: tt.stored,
+				DynamicallyRegistered:   sql.NullBool{Bool: true, Valid: true},
+			})
+
+			rctx := chi.NewRouteContext()
+			rctx.URLParams.Add("client_id", app.ID.String())
+			getReq := httptest.NewRequest(http.MethodGet, "/oauth2/clients/"+app.ID.String(), nil).
+				WithContext(context.WithValue(ctx, chi.RouteCtxKey, rctx))
+			getRW := httptest.NewRecorder()
+
+			oauth2provider.GetClientConfiguration(db).ServeHTTP(getRW, getReq)
+			require.Equal(t, http.StatusOK, getRW.Code, "body: %s", getRW.Body.String())
+
+			var got codersdk.OAuth2ClientConfiguration
+			require.NoError(t, json.NewDecoder(getRW.Body).Decode(&got))
+			require.Equal(t, tt.want, got.TokenEndpointAuthMethod)
+
+			logger := slogtest.Make(t, nil)
+			auditor := audit.NewNop()
+			handler := tracing.StatusWriterMiddleware(oauth2provider.UpdateClientConfiguration(db, &auditor, logger))
+
+			body, err := json.Marshal(codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs:            []string{"https://example.com/callback"},
+				TokenEndpointAuthMethod: tt.resend,
+			})
+			require.NoError(t, err)
+
+			putRCtx := chi.NewRouteContext()
+			putRCtx.URLParams.Add("client_id", app.ID.String())
+			putReq := httptest.NewRequest(http.MethodPut, "/oauth2/clients/"+app.ID.String(),
+				bytes.NewReader(body)).WithContext(context.WithValue(ctx, chi.RouteCtxKey, putRCtx))
+			putReq.Header.Set("Content-Type", "application/json")
+			putRW := httptest.NewRecorder()
+
+			handler.ServeHTTP(putRW, putReq)
+			require.Equal(t, http.StatusOK, putRW.Code, "body: %s", putRW.Body.String())
+
+			var updated codersdk.OAuth2ClientConfiguration
+			require.NoError(t, json.NewDecoder(putRW.Body).Decode(&updated))
+			require.Equal(t, tt.want, updated.TokenEndpointAuthMethod)
+
+			// The row keeps what the client sent, so the response can still
+			// disagree with it.
+			stored, err := db.GetOAuth2ProviderAppByClientID(ctx, app.ID)
+			require.NoError(t, err)
+			require.Equal(t, string(tt.resend), stored.TokenEndpointAuthMethod.String)
+			require.Equal(t, tt.clientType, stored.ClientType)
+		})
+	}
+}
diff --git a/docs/admin/integrations/oauth2-provider.md b/docs/admin/integrations/oauth2-provider.md
@@ -32,7 +32,7 @@
 CODER_EXPERIMENTS=oauth2
 ```

 ## Creating OAuth2 Applications

 ### Method 1: Web UI

@@ -137,6 +137,14 @@
 > also differs by client type. See
 > [Callback URL schemes](#callback-url-schemes).
 
+A client's type is fixed when it registers.
+An RFC 7592 update that would move a client between public and confidential is rejected with `invalid_client_metadata`, since the client either holds a secret that would stop being required or has none and no way to be issued one.
+Switching between `client_secret_basic` and `client_secret_post` is allowed, because both are confidential.
+To change type, register a new client.
+
+Clients registered with `token_endpoint_auth_method: none` before Coder honored it are stored as confidential and still require their `client_secret`.
+Coder reports `client_secret_basic` for those clients so that what it reports matches what it enforces, and the mismatch clears the next time the client updates its registration using the value Coder reported.
+
 If client authentication fails, the token endpoint returns **HTTP 401** with an OAuth2 `invalid_client` error and a `WWW-Authenticate: Basic realm="coder"` response header.
 
 ### Standard OAuth2 Flow
@@ -335,7 +343,7 @@
 This is also how you remove clients that registered themselves while dynamic client registration was enabled.
 Turning the setting off stops new registrations; it does not remove the ones already there.

 ## Testing and Development

 Coder provides comprehensive test scripts for OAuth2 development:


diff --git a/docs/reference/api/enterprise.md b/docs/reference/api/enterprise.md