OIDC token_endpoint_auth_method is not configurable

[obakuhl]

Description

I tried to set up headplane with oidc and I got somehow stuck. After a while, I have found out that with commit 86184e3 token_endpoint_auth_method was removed from config.example.yaml. There is also the following "sentences": [...]# you are using for Headscale. because.
I guess some refactoring in the code deleted more then expected.

Is that intended? token_endpoint_auth_method seems to be mandatory for setting up oidc (at least I got it working with authentik). I am quite new to the project. Maybe there is already something bigger to be implemented with the next version I am not aware of 😁 If it was not intended I can push a PR.

Headplane Version

0.6.1

Headscale Version

0.27.1

[vCBzKbqkezNgArCC]

I have a similar issue in v0.6.2.

My previously working configuration (using token_endpoint_auth_method = "client_secret_basic") now breaks because regardless of what is set in config.yaml headplane is using "client_secret_post" - which my oidc provider does not support.

I believe that headscale only supports client_secret_basic therefore I would not look to change my oidc provider.

[tale]

It was intentionally removed, and I'm sort of on the fence for what to do about it. Most other applications don't provide such a configuration which indicates to me that Headplane had just been doing something wrong for several months.

[eyJhb]

Most services I've encountered defaults to using client_secret_basic, instead of using client_secret_post. SSO providers such as Authelia does not allow client_secret_post by default, and needs to be configured to allow it.

Having the option is not uncommon :)

[tale]

What if I just aligned it like Headscale to only support client_secret_basic?

[eyJhb]

That could work. At least that's fully supported by Authelia :)

…

On 11 January 2026 21.11.50 CET, Aarnav Tale ***@***.***> wrote: tale left a comment (tale/headplane#410) What if I just aligned it like Headscale to only support `client_secret_basic`? -- Reply to this email directly or view it on GitHub: #410 (comment) You are receiving this because you commented. Message ID: ***@***.***>

[eyJhb]

I took a stab at it, and I think the configuration parameter should go back. The reason headscale doesn't have it, is because it automatically detects if it's post or basic. It does this by caching the one that does not error out, and then uses it for the next request. That does not seem ideal. For some reason, I couldn't get this to fully work, it seems to always default to basic? Maybe? Anyways, here is a patch that can be worked on. Didn't want to submit it as a PR.

diff --git a/app/server/config/config-schema.ts b/app/server/config/config-schema.ts
index 8a6e71b..4984608 100644
--- a/app/server/config/config-schema.ts
+++ b/app/server/config/config-schema.ts
@@ -100,14 +100,12 @@ const oidcConfig = type({
 
 	authorization_endpoint: 'string.url?',
 	token_endpoint: 'string.url?',
+	token_endpoint_auth_method: '"client_secret_basic" | "client_secret_post" | "client_secret_jwt" = "client_secret_basic"',
 	userinfo_endpoint: 'string.url?',
 
 	// Old/deprecated options
 	user_storage_file: 'string.lower = "/var/lib/headplane/users.json"',
 	strict_validation: type('unknown').narrow(deprecatedField()).optional(),
-	token_endpoint_auth_method: type('unknown')
-		.narrow(deprecatedField())
-		.optional(),
 });
 
 const partialOidcConfig = type({
@@ -124,14 +122,12 @@ const partialOidcConfig = type({
 
 	authorization_endpoint: 'string.url?',
 	token_endpoint: 'string.url?',
+	token_endpoint_auth_method: '"client_secret_basic" | "client_secret_post" | "client_secret_jwt" = "client_secret_basic"',
 	userinfo_endpoint: 'string.url?',
 
 	// Old/deprecated options
 	user_storage_file: 'string.lower?',
 	strict_validation: type('unknown').narrow(deprecatedField()).optional(),
-	token_endpoint_auth_method: type('unknown')
-		.narrow(deprecatedField())
-		.optional(),
 });
 
 const agentConfig = type({
diff --git a/app/server/web/oidc-connector.ts b/app/server/web/oidc-connector.ts
index 9a00f8f..b142880 100644
--- a/app/server/web/oidc-connector.ts
+++ b/app/server/web/oidc-connector.ts
@@ -194,6 +194,21 @@ async function discoveryCoalesce(
 		errors.push('MISSING_USERINFO_ENDPOINT');
 	}
 
+	let clientAuthMethod: oidc.ClientAuth;
+	switch (config.token_endpoint_auth_method) {
+		case 'client_secret_basic':
+			clientAuthMethod = oidc.ClientSecretBasic(config.client_secret!);
+			break;
+		case 'client_secret_post':
+			clientAuthMethod = oidc.ClientSecretPost(config.client_secret!);
+			break;
+		case 'client_secret_jwt':
+			clientAuthMethod = oidc.ClientSecretJwt(config.client_secret!);
+			break;
+		default:
+			throw new Error('Invalid token_endpoint_auth_method set');
+	}
+
 	if (errors.length > 0) {
 		return errors;
 	}
@@ -208,6 +223,7 @@ async function discoveryCoalesce(
 		},
 		config.client_id,
 		config.client_secret,
+		clientAuthMethod, 
 	);
 
 	return oidcClient;