#dev 2017-12-10

2017-12-10 UTC

Zegnat You could on verification have the authorization endpoint say for what type it issued its code. If it isn’t `code`, but `id`, a token endpoint could refuse to issue a token. Was my first thought.