> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Strict checking on client authentication parameters

> Strict checking on client authentication parameters in Authlete version 2.0 requires specific configurations and values in token requests with differences from the previous version to note during migration.

## Overview

Authlete version 2.0 and later strictly check client type and client authentication method settings, and values specified in token requests. Some requests which are valid for Authlete 1.1 may be refused.

## Difference between 1.1 and 2.0 (and later)

|                     | Authlete 1.1                                                                                                                                                                                                                                                                                                                                                  | Authlete 2.0 and later                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Verification policy | When client secret is included in a token request, Authlete always verifies its value regardless of configuration (it ignores settings for client type and client authentication method). Authlete accepts a token request with no `client_id` because it can derive the client identifier from other parameters such as authorization code or refresh token. | Verification behavior varies with configured values of client type and client authentication method. A) Client type = `public`: client authentication method must be `none`; other values cause an error. B) Client type = `confidential`: client authentication method must not be `none`; if method is `client_secret_basic`, client secret must be sent in the `Authorization` header; if method is `client_secret_post`, client secret must be sent in request body. |
| Default settings    | Client type: `public`; client authentication method: `client_secret_basic`                                                                                                                                                                                                                                                                                    | Client type: `public`; client authentication method: `none`                                                                                                                                                                                                                                                                                                                                                                                                              |

##  Notes on migrating from Authlete 1.1 to 2.0 and later

In version 1.1, if you have specified client\_secret\_basic as client authentication method and some client sends a request with client secret in request body, Authlete verifies the value.

In version 2.0 and later, clients must include client secret in Authorization header if you have specified client\_secret\_basic as client authentication method. Thus Authlete 2.0 responds error against such request that is valid for Authlete 1.1.