2018-08-08 UTC
# 
@aaronpk ↩️ But, most importantly, the fact that IndieAuth uses a URL for the client ID means that you *do* authenticate the client in the initial Auth Code request, since the redirect URL has to match the domain or be registered. That's an improvement over OAuth with no secret. (twitter.com/_/status/1027184706167615490)