Thank you for the detailed reply!
I think it can still make sense for some situations. But it seems like the Authorization Code flow (Discourse’s default) with PKCE (optional in Discourse) is the most-recommended way to use OIDC.
This is very interesting - I didn’t fully grasp PKCE until now. Based on my reading of auth0’s documentation, it seems like (in certain configurations) this flow has the advantages of the implicit flow (no client secret) with none of the downsides.
Is this perhaps something that can be done instead? It looks like it’s simple as removing the client secret parameter from the /token endpoint.
And ultimately, my main concern is just eliminating the requirement for a client secret 