title: App Services EasyAuth for protecting API with OIDC
body: <p>I currently have a solution where I have an OIDC provider, a client that obtained a token from that provider, and a protected resource (API).</p>
  <p>Currently I'm using Easy Auth on the API, so far it seems to validate the token correctly. The only problem is the API needs a secret (not optional).</p>
  <p>In my experience, the API should be able to check the signature, audience and expiration etc without needing a client_id and client_password itself. It seems to me that Easy Auth assumes that everything is a client.</p>
  <p>Is there a way to secure an API with Easy Auth OIDC, where the API does not require a secret but will just validate the token knowing the IDP? (Or do I <em>need</em> to use another Azure product such as API Management)</p>
  <p><a href="https://i.stack.imgur.com/b6qW5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/b6qW5.png" alt="enter image description here" /></a></p>
  <p><strong>Edit</strong>: I think I just learned that in this situation I can add any bogus value to secret and it is not used. The Client ID is used as Audience for validation by Easy Auth.</p>
  <ul>
  <li><code>Client ID</code> is used as <code>Audience</code> for token validation by Easy Auth.</li>
  <li><code>Client secret</code> is ignored completely by Easy Auth. Can be any value.</li>
  </ul>