title: springdoc-openapi-ui OAuth 2.0 Authorization Code flow with PKCE
body: <p>I am using the swagger with springdoc-openapi-ui-1.4.3</p>
  <pre><code>@SecurityRequirement(name = &quot;security_auth&quot;)
  public class ProductController {}
  </code></pre>
  <p>Setting the security schema</p>
  <pre><code>@SecurityScheme(name = &quot;security_auth&quot;, type = SecuritySchemeType.OAUTH2,
          flows = @OAuthFlows(authorizationCode = @OAuthFlow(
                  authorizationUrl = &quot;${springdoc.oAuthFlow.authorizationUrl}&quot;
                  , tokenUrl = &quot;${springdoc.oAuthFlow.tokenUrl}&quot;,scopes = {
                  @OAuthScope(name = &quot;IdentityPortal.API&quot;, description = &quot;IdentityPortal.API&quot;)})))
  public class OpenApiConfig {}
  </code></pre>
  <p>Security config</p>
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {// @formatter:off
          http
                  .authorizeRequests()
                  .antMatchers(&quot;/v3/api-docs/**&quot;, &quot;/swagger-ui/**&quot;, &quot;/swagger-ui.html&quot;)
                  .permitAll()
                  .antMatchers(HttpMethod.GET, &quot;/user/info&quot;, &quot;/api/foos/**&quot;)
                  .hasAuthority(&quot;SCOPE_read&quot;)
                  .antMatchers(HttpMethod.POST, &quot;/api/foos&quot;)
                  .hasAuthority(&quot;SCOPE_write&quot;)
                  .anyRequest()
                  .authenticated()
                  .and()
                  .oauth2ResourceServer()
                  .jwt();
      }
  }
  </code></pre>
  <p>With dependencies</p>
  <pre><code>implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
  implementation 'org.springdoc:springdoc-openapi-ui:1.4.3'
  implementation 'org.springdoc:springdoc-openapi-security:1.4.3'
  implementation &quot;org.springframework.boot:spring-boot-starter-security&quot;
  </code></pre>
  <p>Config setting</p>
  <pre><code>spring:
    profiles:
      active: dev
  
  ####### resource server configuration properties
    security:
      oauth2:
        resourceserver:
          jwt:
            issuer-uri: https://localhost:5001
            jwk-set-uri: https://localhost:5001/connect/token
  springdoc:
    swagger-ui:
      oauth:
        clientId: Local
        usepkcewithauthorizationcodegrant: true
    oAuthFlow:
      authorizationUrl: https://localhost:5001
      tokenUrl: https://localhost:5001/connect/token
  </code></pre>
  <p>In the swagger UI, the clientId is empty and client secret is present, for authorization code + PKCE flow client secret should not present</p>
  <p><a href="https://i.stack.imgur.com/imalW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/imalW.png" alt="enter image description here" /></a></p>