Client secret key is not used in get_user_profile?

[heydarshahi]

Hi!

I was playing around with the get_user_profile example and realized that the client secret key is not used in the authentication process. I thought this was necessary for authentication. Does that mean it's not the case?
Thanks for the help in advance!

Amin

[ryandougc]

The get_user_profile example uses the "authorization code with PKCE" method, which you can read about here. It is meant for client side authorization, in situations where the client secret cannot be stored securely. It uses a verification method instead of the client secret