1
-- Apply before the 1.7 schema/Worker cutover. These four existing apps use
2
-- ClientSecretPost. Only registration metadata changes; secrets stay intact.
3
-- Do not include tres: both its backends must use Basic for their shared client.
4
UPDATE oauth_clients
5
SET token_endpoint_auth_method = 'client_secret_post'
6
WHERE client_id IN (
7
  'JmdxvkWCtYPlJyYzEmsmrRKqVVkqaDTH', -- anvil
8
  'yjghWbdLExBTqCfMroCNFprsIsBWcpTZ', -- bland
9
  'SOkHjqnAkmcQkiNFgZobhpjIcTEFbtaL', -- flamemail admin
10
  'FfBngpAjBSDkXZuNSRqvlCEPKgVNFVxO'  -- git-on-cloudflare
11
)
12
  AND token_endpoint_auth_method = 'client_secret_basic'
13
  AND client_secret IS NOT NULL
14
  AND length(client_secret) > 0
15
RETURNING name, token_endpoint_auth_method;