# OAuth2 without a client secret? - OAuth2 Authorization Code w/PKCE Flow???

**URL:** <https://community.hubspot.com/t/oauth2-without-a-client-secret-oauth2-authorization-code-w-pkce-flow/54787>\
**Category:** APIs & Integrations\
**Tags:** oauth\
**Created:** [April 11, 2022, 3:57pm UTC](https://community.hubspot.com/t/oauth2-without-a-client-secret-oauth2-authorization-code-w-pkce-flow/54787 "2022-04-11T15:57:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![IntegrationDev](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/integrationdev/32/1529_2.png) [@IntegrationDev](https://community.hubspot.com/u/IntegrationDev)\
**Post date:** [April 11, 2022, 3:57pm UTC](https://community.hubspot.com/t/oauth2-without-a-client-secret-oauth2-authorization-code-w-pkce-flow/54787/1 "2022-04-11T15:57:55Z")

</div>

Hello,

Over the past year (since [this post](https://community.hubspot.com/t5/APIs-Integrations/oAuth-without-client-secret-for-single-page-app-SPA-and-command/m-p/410131/highlight/true#M40587)), have any options opened up for using OAuth2 with HubSpot without passing a client secret?  
I’m working on an integration to HubSpot that is client hosted in a scenario somehwat similar to a single-page application (SPA).

Storing/using a client secret in this scenario is **not** ideal. It would be much better to use OAuth2’s Authorization Code Flow with Proof Key for Code Exchange (PKCE), which avoids the need for that secret.

Hoping there’s an option to do this. 🙂

In worse case, I may have to fall back to using private app registrations, but that may preclude my integration from being listed in the App Marketplace. 😞

Thank you!

---

<div class="post-metadata">

**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\
**Post date:** [April 18, 2022, 5:38pm UTC](https://community.hubspot.com/t/oauth2-without-a-client-secret-oauth2-authorization-code-w-pkce-flow/54787/2 "2022-04-18T17:38:05Z")

</div>

@IntegrationDev

Apologies for the delayed response. The answer in that post still holds true 😥

I would suggest creating an [idea](https://community.hubspot.com/t5/Ideas/ct-p/ideas) and posting the idea link on this thread for anyone else looking for this functionality to upvote it.

---

<div class="post-metadata">

**Author:** ![IntegrationDev](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/integrationdev/32/1529_2.png) [@IntegrationDev](https://community.hubspot.com/u/IntegrationDev)\
**Post date:** [April 20, 2022, 1:29pm UTC](https://community.hubspot.com/t/oauth2-without-a-client-secret-oauth2-authorization-code-w-pkce-flow/54787/3 "2022-04-20T13:29:28Z")

</div>

Thank you, @dennisedson! Done.

Here’s the link to the Idea proposing this change: [https://community.hubspot.com/t5/HubSpot-Ideas/OAuth2-Support-Authorization-Code-Flow-with-Proof-Key-for-Code/idi-p/618900#M110136](https://community.hubspot.com/t5/HubSpot-Ideas/OAuth2-Support-Authorization-Code-Flow-with-Proof-Key-for-Code/idi-p/618900#M110136)