# Permit the use of "none" in supported token endpoint auth methods

**URL:** <https://discuss.liferay.com/t/permit-the-use-of-none-in-supported-token-endpoint-auth-methods/186>\
**Category:** Product Ideas\
**Tags:** product\
**Created:** [December 2, 2025, 12:51pm UTC](https://discuss.liferay.com/t/permit-the-use-of-none-in-supported-token-endpoint-auth-methods/186 "2025-12-02T12:51:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![briansuh](https://dub1.discourse-cdn.com/flex014/user_avatar/discuss.liferay.com/briansuh/32/433_2.png) [@briansuh](https://discuss.liferay.com/u/briansuh)\
**Post date:** [December 2, 2025, 12:51pm UTC](https://discuss.liferay.com/t/permit-the-use-of-none-in-supported-token-endpoint-auth-methods/186/1 "2025-12-02T12:51:29Z")

</div>

**What is the problem you are trying to solve?**

In cases where OIDC is configured to use `none` as a supported token endpoint authentication method, Liferay does not permit this thereby breaking Public clients from working properly.

To provide context, setting `none` aids with the use of Public clients in case where we do not want to store client secrets. In these scenarios, Proof Key for Code Exchange (PKCE) is a common security method to protect the authorization code grant flow.

**What is your project about? (e. g. Intranet, Partner Portal, Enterprise Website, etc)**

This is an authentication implementation on a public site.

**What is your proposed solution? (optional)**

Please permit the use of `none` as a supported token endpoint auth method. This would ensure that Liferay closely adheres to OIDC standards with respect to public clients.