# Standard flow and access type **URL:** \ **Category:** Configuring the server\ **Tags:** authentication\ **Created:** [December 15, 2021, 2:37pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625 "2021-12-15T14:37:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nestle2377](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nestle2377/32/3163_2.png) [@nestle2377](https://forum.keycloak.org/u/nestle2377)\ **Post date:** [December 15, 2021, 2:37pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/1 "2021-12-15T14:37:20Z")
Hi to all, I’ve a question regarding the access type and the authentication flow. If I set in a realm the access type to public i can enable the standard flow (like the implicit flow) With standard flow I’ve to use the code and the client secret to close the authentication flow. the problem is that using “public” like access type is not present the credential tab, so I haven’t the client secret. is normal? thanks! ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [December 15, 2021, 3:50pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/2 "2021-12-15T15:50:10Z")
Standard auth code flow is also possible for public clients. There’s no restriction that a client needs a clientId **and** secret, only the confidential clients need this. Public clients have to be properly configured with valid redirect uri’s and you SHOULD enable and enforce PKCE, this makes it more secure. Don’t use implicit flow at all, it’s strongly discouraged as it is considered insecure as of todays knowledge. ---
**Author:** ![nestle2377](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nestle2377/32/3163_2.png) [@nestle2377](https://forum.keycloak.org/u/nestle2377)\ **Post date:** [December 15, 2021, 4:13pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/3 "2021-12-15T16:13:46Z")
Thanks for reply! maybe I’m missing something. If I configure a client to use the standard flow, then i’ve to configure my client to send the response type “token code”. using “token code” I can retrieve from the authorization server only the code and not the access token. with the code and without the secret I can’t retrieve the access token. for example using the oidc debugger site and setting like response type code I correctly retrieve from my keycloak server only the code that I’ve to spent again with authorization server to retrieve the access token. but since I’m i public client I’ven’t the secret to use with the code. I don’t know If I’ve explain it well. thanks! ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [December 15, 2021, 5:23pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/4 "2021-12-15T17:23:17Z")
Do you have idea how to enforce PKCE flow for public client in the Keycloak, please? I’m not able to find any config for that, so I’m curious how to force it. Thanks. ---
**Author:** ![nestle2377](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nestle2377/32/3163_2.png) [@nestle2377](https://forum.keycloak.org/u/nestle2377)\ **Post date:** [December 15, 2021, 5:56pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/5 "2021-12-15T17:56:49Z")
Ok, I’ve search on internet. keycloak is already pkce compliant, you have to select public, standard flow and eventually the Proof Key for Code Exchange Code Challenge Method in advanced settings. Client side the call to keycloak should include the appropriate parameters like code\_challenge. thanks for clarifications ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [December 15, 2021, 6:13pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/6 "2021-12-15T18:13:34Z")
@nestle2377 already found it… 🙂 It‘s located in „Advanced Settings“: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/b/bd6c279b001edf679b00a6d385ec2e2a8c4111ba.jpeg) ---
**Author:** ![tania](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/tania/32/9460_2.png) [@tania](https://forum.keycloak.org/u/tania)\ **Post date:** [February 27, 2024, 2:33pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/7 "2024-02-27T14:33:34Z")
Hi all, I am using keycloak server 21.0.2 and into the client settings i have this regarding the type of the flows ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/7/7c9a7a0dccc1ad6999c0ae2f3c5754f94a9614dd.png) Currently the tokens are generated using authentication code generated by keycloak and secret key of the client. I don’t see anywhere in the current configuration of the version of the keycloak server, to configure it as public. One more question: Which configuration settings should be used in order to validate the tokens? How an application using OpenId can validate the tokens that are actually generated by keycloak? Thank you in advance. ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [February 27, 2024, 6:16pm UTC](https://forum.keycloak.org/t/standard-flow-and-access-type/12625/8 "2024-02-27T18:16:00Z")
Click on the questionmark at “Client authentication”, there it’s mentioned that if client authentication is on, it’s a confidential client, if it is off, it’s a public client. > [@tania](#): > > One more question: Which configuration settings should be used in order to validate the tokens? How an application using OpenId can validate the tokens that are actually generated by keycloak? Use a proper OIDC library in your client, which does that for you. Don’t implement it on your own.