Conventions

We want to do things right from the beginning, and avoid issues and complexity.

The Client will be configured with:

• AuthCode+PKCE as authentication flow.
• Mutual TLS (SSL).
• RedirectUris will be enforced for all clients.

Check for more information of each convention:

• Authentication Flow
• Mutual TLS (SSL)
• Client Configuration

What we don't want right now?

Will not use consent nor scopes or devices for now. Will use Scopes in the future only for external network UI against BFF.