I have an API secured with bearer tokens issued by IdentityServer.
Some applications use client_credentials flow (which requires a client_secret), and a web UI uses authorization_code (with PKCE) (which does not require a client_secret.
On the swagger page in the authorization modal the client_secret text box is either present for both cases or absent for both cases according to whether I
.OAuthUsePkce();
in UseSwaggerUI.
Can I get both flows to work or does it have to be one or the other?