> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Service Flags

> Configure various flags in Authlete to enforce stricter requirements to meet OAuth/OIDC specifications.

## Overview

Over the years, Authlete has implemented a large number of standard specifications. Among them, there have been several occasions where changes to Authlete’s implementation were necessary due to overlooked details, misinterpretations, or breaking changes in the specifications themselves. This article shares various flags created from these challenges.

Service flags in Authlete provide essential configuration flexibility that allows developers to fine-tune the behavior of their OAuth 2.0 and OpenID Connect implementations. These boolean switches and configuration parameters enable organizations to balance strict specification compliance with practical deployment considerations.

Service flags serve multiple crucial purposes:

* Allow gradual migration to stricter compliance requirements without breaking existing integrations
* Provide options for handling edge cases or ambiguities in the specifications
* Enable customization of security policies to meet specific organizational requirements
* Facilitate interoperability with a wide range of client applications, including those that may not fully comply with the latest standards

## Flags for Specification Compliance

The table below shows an overview of the Authlete service flags:

| Flag                                                | Type                   | Description                                                                                                                                                                                                                                                                                                                                 | Default Value |
| --------------------------------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
| Service.missingClientIdAllowed                      | Boolean                | When set to `true` or `enabled` in the console, the client is identified from the authorization code when the `client_id` request parameter is missing.                                                                                                                                                                                     | False         |
| Service.claimShortcutRestrictive                    | Boolean                | Ensures strict adherence to the OpenID Connect specification regarding claim embedding. When set to `true` or enabled in the console, it ensures that claims requested by the profile, email, address, and phone scope values are only included in the ID Token if no Access Token is issued.                                               | True          |
| Service.dcrDuplicateSoftwareIdBlocked               | Boolean                | When set to `True`, Authlete rejects dynamic client registration requests containing a registered `software_id`                                                                                                                                                                                                                             | False         |
| Service.dcrScopeUsedAsRequestable                   | Boolean                | Limits the range of scopes that the client application can request. When set to `True`, follows RFC 7591 standard by treating scopes specified during dynamic client registration as requestable scopes.                                                                                                                                    | False         |
| Service.frontChannelRequestObjectEncryptionRequired | Boolean                | When sending a request object via the front channel, it must be encrypted.                                                                                                                                                                                                                                                                  | False         |
| Service.idTokenAudType                              | Array, String, or Null | Addresses the JWT specification flexibility where the `aud` claim can be either an `array` or a `single string`, causing inconsistency in how receiving systems must process tokens. It can also be overridden at runtime using the `idTokenAudType` parameter in Authlete APIs that issue ID tokens (such as `/auth/authorization/issue`). | Null          |
| Service.idTokenReissuable                           | Boolean                | controls whether the `/auth/token` API returns `ID_TOKEN_REISSUABLE`. When set to `True`, the /`auth/token` API returns `"action": "ID_TOKEN_REISSUABLE"` if the conditions are all met.                                                                                                                                                    | False         |
| Service.issSuppressed                               | Boolean                | When set to `True`, does not include iss response parameter in the authorization response.                                                                                                                                                                                                                                                  | False         |
| Service.loopbackRedirectionUriVariable              | Boolean                | Controls how the authorization server handles port numbers in loopback IP address redirection URIs during OAuth 2.0 flows. When set to `True`, Treats the port number as variable when the host part of the redirection URI is a loopback IP address, following RFC 8252 Section 7.3                                                        | False         |
| Service.nbfOptional                                 | Boolean                | When set to `True`, the authorization server does not enforce the request object lifespan check, even in scenarios where FAPI 1.0 Part 2 compliance would normally require it. In other words, the `nbf` claim is treated as optional rather than mandatory.                                                                                | False         |
| Service.refreshTokenIdempotent                      | Boolean                | When set to `True` or enabled in the console, ensures consistent results for duplicate token refresh requests within a 60-second window, preventing issues when the same refresh token is used multiple times.                                                                                                                              | False         |
| Service.refreshTokenKept                            | Boolean                | Controls the behavior of refresh token rotation. When set to `True`, refresh token rotation will not occur.                                                                                                                                                                                                                                 | True          |
| Service.requestObjectEncryptionAlgMatchRequired     | Boolean                | The algorithm specified in the alg parameter of the encrypted request object must be a specific value.                                                                                                                                                                                                                                      | False         |
| Service.requestObjectEncryptionEncMatchRequired     | Boolean                | The algorithm specified in the `enc` parameter of the encrypted request object must be a specific value.                                                                                                                                                                                                                                    | False         |
| Service.scopeRequired                               | Boolean                | Controls how authorization requests without a scope parameter are handled.  When set to `True`, Authorization requests without a scope parameter will either use configured default scopes or be rejected with an invalid scope error if no defaults exist.                                                                                 | False         |
| Service.traditionalRequestObjectProcessingApplied   | Boolean                | Allows switching between processing request objects using the OIDC Core method (for backward compatibility) or the RFC 9101 method.                                                                                                                                                                                                         | False         |
| Service.unauthorizedOnClientConfigSupported         | Boolean                | When this flag is set to true, Authlete will return UNAUTHORIZED where applicable. When false, for backward compatibility, Authlete will return `BAD_REQUEST` instead (even though this does not strictly follow RFC 7592).                                                                                                                 | False         |

## Configure Flags in the  Management Console

Starting with Authlete 3.0, flags have been introduced in the management console to enforce strict requirements to meet OAuth/OIDC specifications.

The following sections demonstrate configuring service setting flags in the [Authlete Management Console](https://console.authlete.com/):

### Client ID Omission

To Configure the `Service.missingClientIdAllowed` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Token > General**
2. To enable the flag, toggle the `“Client ID Omission"` option.
3. Click Save Changes to apply the updates.

![Client ID Omission](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/1.png)

*Client ID Omission*

### Restrict Shortcut

To Configure the `Service.claimShortcutRestrictive` flag in the management console:

1. Navigate to **Service Settings > Tokens and Claims > Claims > Supported Claims**
2. To turn on, toggle the `“Restrict Shortcut”` option.
3. Click Save Changes to apply the updates.

![Restrict Shortcut](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/2.png)

*Restrict Shortcut*

### DCR with Duplicate Software ID

To Configure the `Service.dcrDuplicateSoftwareIdBlocked` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Advanced > Dynamic Client Registration**
2. Go to`“DCR with Duplicate Software ID”` and toggle the `Accept` option.
3. Click Save Changes to apply the updates.

![DCR with Duplicate Software ID](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/3.png)

*DCR with Duplicate Software ID*

### DCR's Scope Parameter

To Configure the `Service.dcrScopeUsedAsRequestable` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Advanced > Dynamic Client Registration**
2. Go to `"DCR's Scope Parameter"` and toggle the `Enable` option.
3. Click Save Changes to apply the updates.

![DCR's Scope Parameter](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/4.png)

*DCR's Scope Parameter*

### Encryption in Front Channel

To Configure the `Service.frontChannelRequestObjectEncryptionRequired`  flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization > Request Object**
2. Go to `"Encryption in Front Channel"` and toggle the `Require` option.
3. Click Save Changes to apply the updates.

![Encryption in Front Channel](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/5.png)

*Encryption in Front Channel*

### Choose Audience Claim Format

To Configure the `Service.idTokenAudType`  flag in the management console:

1. Navigate to **Service Settings > Tokens and Claims > ID Token**
2. Open the `“Choose Audience Claim Format”` menu and  select an option.
3. Click Save Changes to apply the updates.

![Choose Audience Claim Format](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/6.png)

*Choose Audience Claim Format*

### Enable Reissuable

To Configure the `Service.idTokenReissuable` flag in the management console:

1. Navigate to **Service Settings > Tokens and Claims > ID Token**
2. Under `ID Tokens` section,  toggle the `"Enable Reissuable”` option.
3. Click Save Changes to apply the updates.

![Enable Reissuable](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/7.png)

*Enable Reissuable*

### Issuer Identification Response Parameter

To Configure the `Service.issSuppressed` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization**
2. Under `"Issuer Identification Response Parameter"`, toggle the `Suppress iss Response Parameter` option.
3. Click Save Changes to apply the updates.

![Issuer Identification Response Parameter](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/8.png)

*Issuer Identification Response Parameter*

### Loopback Redirection URI

To configure the `Service.loopbackRedirectionUriVariable` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization > General**
2. Go to `"Loopback Redirection URI"` and toggle the `Loopback Redirection URI` option.
3. Click Save Changes to apply the updates.

![Loopback Redirection URI](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/9.png)

*Loopback Redirection URI*

### nbf claim

To configure the `Service.nbfOptional` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization > Request Object**
2. Go to `"nbf claim""` and toggle the `"Require"` option.
3. Click Save Changes to apply the updates.

![nbf claim](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/10.png)

*nbf claim*

### Enable Idempotency

To configure the  `Service.refreshTokenIdempotent` flag in the management console:

1. Navigate to  **Service Settings > Tokens and Claims > Refresh Tokens > General**
2. Under `Refresh Token Rotation`, toggle the `Enable Idempotency` option.
3. Click Save Changes to apply the updates.

![Enable Idempotency](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/11.png)

*Enable Idempotency*

### Enable Token Rotation

To configure the  `Service.refreshTokenKept` flag in the management console:

1. Navigate to **Service Settings > Token and Claims > Refresh Tokens**
2. Under `Refresh Token Rotation`, toggle the `"Enable Token Rotation"` option. By default `Enable Token Rotation` is enabled.
3. Click Save Changes to apply the updates.

![Enable Token Rotation](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/12.png)

*Enable Token Rotation*

### Encryption Algorithm Match

To configure the  `Service.requestObjectEncryptionAlgMatchRequired` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization > Request Object**
2. Go to the `"Encryption Algorithm Match"` option, toggle `Require`.
3. Click Save Changes to apply the updates.

![Encryption Algorithm Match](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/13.png)

*Encryption Algorithm Match*

### Encryption Encoding Algorithm Match

To configure the  `Service.requestObjectEncryptionEncMatchRequired` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization > Request Object**
2. Go to the  `"Encryption Encoding Algorithm Match"` and toggle `Require`.
3. Click Save Changes to apply the updates.

![Encryption Encoding Algorithm Match](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/14.png)

*Encryption Encoding Algorithm Match*

### Requests Without Scope Parameter

To configure the  `Service.scopeRequired` flag in the management console:

1. Navigate to **Service Settings > Tokens and Claims > Advanced  > Scopes**
2. Go to `"Requests Without Scope Parameter"` and toggle `Reject`.
3. Click Save Changes to apply the updates.

![Requests Without Scope Parameter](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/15.png)

*Requests Without Scope Parameter*

### Request Object Processing

To configure the  `Service.traditionalRequestObjectProcessingApplied` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Authorization > Request Object**
2. Go to `"Request Object Processing"` and toggle the `Enable JAR Compatibility` option.
3. Click Save Changes to apply the updates.

![Request Object Processing](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/16.png)

*Request Object Processing*

### Return UNAUTHORIZED

To configure the  `Service.unauthorizedOnClientConfigSupported` flag in the management console:

1. Navigate to **Service Settings > Endpoints > Advanced > Dynamic Client Registration**
2. Go to `"Client Configuration Error Behavior"` option and toggle `Return UNAUTHORIZED`.
3. Click Save Changes to apply the updates.

![Return UNAUTHORIZED](https://storage.googleapis.com/authlete-website/resources/kb/flag-options/17.png)

*Return UNAUTHORIZED*

## Example Request

Service Configurations for `Service.setUnauthorizedOnClientConfigSupported` flag. The following example uses a POST request [/api/{serviceId}/service/update](https://docs.authlete.com/en/shared/latest#post-/api/-serviceId-/service/update).

* Authlete API Request that shows how to update the `unauthorizedOnClientConfigSupported` flag to `true`.

```

curl -v -X POST https://us.authlete.com/api/21653835348762/service/update \
  -H 'Content-Type:application/json' \
  -H 'Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F' \
  -d '{
    "unauthorizedOnClientConfigSupported": true
  }'

```

Make sure to replace the following credentials in the actual request:

* `YOUR_SERVICE_ID` and
* `Access Token` with your actual service credentials
* API Cluster - US, JP, EU, BR

## Further Reading

* For more in-depth information, see [OAuth/OIDC Implementation Mistakes! How We Overcame Overlooked Details and Breaking Changes in the Specifications](https://darutk.medium.com/oauth-oidc-mistakes-7f3bb909518b)