Moving an OIDC client to PKCE

[Peter Schober]

Wessel, Keith via users <users at shibboleth.net> [2025-02-13 18:59 CET]:
> As a transition, is there a way to allow a given client to use
> standard token-based auth _or_ PKCE? The idea would be to allow both
> methods, let the app developer push out a new version of the app
> that switches to PKCE, then after a sufficient amount of time for
> users to update to the new app version, begin forcing PKCE.

How's that different from enforcing the new settings for the new
client_id and once a new version of the "app" is pushed out it would
start using the new client_id and hence the new settings?
(I'm probably missing something.)

Best,
-peter