OIDC for Mobile App

[Hall, Gerry]

I have a mobile app that requires OIDC and preferably without a client_secret.
Adding the config without a client_secret I get an error (below).
If I add the config with a client_secret it works as expected.

Can someone tell me what I am doing wrong?

Config with no client_secret throws error.
{
  "client_id": “FooMobileApp",
  "response_types": ["code"],
  "scope": "openid profile email offline_access",
  "redirect_uris": [“foo.mobile://oauthredirect/"],
  "token_endpoint_auth_method": "none",
  "pkce_required": true,
  "application_type": "native",
  "grant_types": ["authorization_code"]
}
When I test,  I get the following error:
Content:{
        "error" : "invalid_client",
        "error_description" : "Client authentication failed"
      }

Config with a client_secret works as expected:
{
  "client_id": "FooMobileApp",
  "response_types": ["code"],
  "scope": "openid profile email offline_access",
  "redirect_uris": [foo.mobile://oauthredirect/"],
  "client_secret": “XXXXXXXXXXXXXXXXXXXX",
  "token_endpoint_auth_method": "client_secret_post"
}
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250806/ed74d559/attachment.htm>