Support for SSO Provider with Authorization Code Flow with PKCE

[chriskhanhtran-verisk]

I am integrating my Okta application, which uses the authorization code flow with PKCE, into your platform. To enable seamless SSO integration, I need two options in the OktaProvider configuration:

code

OktaProvider({
    checks: ['pkce'],
    client: { token_endpoint_auth_method: 'none' },
    ...
}),

Currently, I noticed the customSsoProvider includes checks: ["pkce", "state"] (code), which works for configuring checks. However, there’s no way to specify client: { token_endpoint_auth_method: 'none' } in the provider options.

References:

• Okta OAuth Guide
• NextAuth.js Issue #3466
• Okta PKCE Integration Forum Post

Could you please add support for configuring checks and token_endpoint_auth_method via environment variables? PKCE is a widely-used flow for OAuth 2.0 and OpenID Connect, and adding this functionality would improve compatibility with Okta and other similar providers.

Thank you for considering this enhancement!

Additional information

Okta application config:

SDK and container versions

Image: langfuse/langfuse:3

[marcklingen]

thanks for creating the issue to track this!
#4799