include the client authentication parameters in the request URI.

Condition: When using request-body client password authentication

MUST NOT be included in the request URI

include the `client_id` parameter.

Condition: When using request-body client credentials corresponding to `client_secret_post`

client_id REQUIRED

include the `client_secret` parameter.

Condition: When using request-body client credentials corresponding to `client_secret_post`, except when the secret is an empty string and the permitted omission is used

client_secret REQUIRED

limit use of request-body client credentials to clients unable to directly use HTTP Basic or another password-based HTTP authentication scheme.

Condition: When selecting request-body client password authentication

SHOULD be limited to clients unable to directly utilize the HTTP Basic authentication scheme

omit the `client_secret` parameter.

Condition: When the client secret is an empty string

client MAY omit the parameter if the client secret is an empty string

require TLS for requests using password authentication.

Condition: When receiving client password authentication requests

MUST require the use of TLS

protect every endpoint using this authentication method against brute-force attacks.

Condition: When an endpoint uses client password authentication

MUST protect any endpoint utilizing it against brute force attacks

enforce client authentication.

Condition: When credential issuance or registration and credential confidentiality are feasible in the deployment

Authorization servers SHOULD enforce client authentication if it is feasible

support including client credentials in the request body.

Condition: For client password authentication

authorization server MAY support including the client credentials in the request-body

use asymmetric cryptography for client authentication.

Condition: When selecting supported client authentication methods

RECOMMENDED to use asymmetric cryptography for client authentication

implement and use the `token_endpoint_auth_method` client metadata field.

Condition: Unless another requirement states otherwise

implementation and use of all client metadata fields is OPTIONAL

accept a requested authentication method name that matches another registered name case-insensitively.

Condition: When registering an OAuth Token Endpoint Authentication Method name

SHOULD NOT be accepted