Identity Server 4 Authorization Code Flow with Client Credentials (allowing one client instance deny another)

What I got so far:

In a project I have an authorization server (Identity Server 4), some (let's say two) protected APIs (Api Resource) and some trusted clients (automated, no user interaction) which should access the Identity Server via the backchannel (right?). Imagine the client is a Amazon Fire TV box kind thingy.

According to what I have read so far over the last weeks a suitable flow for this scenario is the OpenID Connect Authorization Code Flow.

• clients are trusted (and can maintain a secret)
• Authorization Code flow supports refresh tokens (which I want to use)
• the client is actually not the resource owner but requires access to the full api resource

What I have in my (theoretical) structure:

I have two API Resources (one resource for each API version)

• api.v1
• api.v2

I also have two series of my API clients

• client.v1 supports only api v1 & should only have access to api.v1 resource
• client.v2 supports api v1 & v2 and therefore should have access to both api resources

Identity Server 4 StartUp.cs configuration (so far)

public void ConfigureServices(IServiceCollection services)
{
    // configure identity server with in-memory stores, keys, clients and scopes
    services.AddIdentityServer()
        .AddDeveloperSigningCredential()
        .AddInMemoryApiResources
        ( 
            new List<ApiResource>
            {
                new ApiResource("api.v1", "API v1"),
                new ApiResource("api.v2", "API v2")
            }
        )
        .AddInMemoryClients
        (
            new List<Client>
            {
                new Client
                {
                    ClientId = "client.v1",
                    AllowedGrantTypes = GrantTypes.CodeAndClientCredentials,
                    AllowAccessTokensViaBrowser = false,
                    ClientSecrets = { new Secret("secret1".Sha256()) },
                    AllowedScopes = { "api.v1" }
                },
                new Client
                {
                    ClientId = "client.v2",
                    AllowedGrantTypes = GrantTypes.CodeAndClientCredentials,
                    AllowAccessTokensViaBrowser = false,
                    ClientSecrets = { new Secret("secret2".Sha256()) },
                    AllowedScopes = { "api.v1", "api.v2" }
                }
            }
        );
}

The theory what I am struggling with is the authorization code part.

I want to have each client instance (again imagine it as a small box) a different authorization code allowing one instance access but deny fo another one.

Is the authorization code intended to be used for that?

And one important thing I haven't understood in all the time: CodeAndClientCredentials defines two grant types. Does this mean connecting with that requires both (code AND client credentials) or is it an one of them definition (code OR client credentials).

The Identity Server 4 code I am struggling with is:

In the code defining the client I can only find AuthorizationCodeLifetime but no field to set the authorization code itself.

It seems I can define a list of client secrets.

ClientSecrets = { new Secret("secret1".Sha256()) },

Does this mean one client Id can have multiple secrets used? Are different client secrets better suitable for my "allow one deny the other" problem?

Edit

Ok, I have re-read that and now I got it (at least a bit more): the authorization code is not defined sent by the client but the client receives it.

The authorization code flow returns an authorization code (like it says on the tin) that can then be exchanged for an identity token and/or access token. This requires client authentication using a client id and secret to retrieve the tokens from the back end

from this blog here

But how would I have to configure my Identity Server to allow one instance and deny another.

By using different client secrets? Using extension grants?