Genesys Cloud is deprecating the Token Implicit Grant (Browser) option when adding a new or editing an existing OAuth client. Instead of the Implicit Grant option, Genesys recommends using the existing Proof Key for Code Exchange (PKCE) grant type for OAuth 2 authorization. PKCE provides a more secure workflow as recommended by OAuth 2.0 Security Best Practice. PKCE grant is also an extension of the authorization code flow for use by public clients, for more information, see the Genesys Cloud Developer Center.

FAQs

Am I affected?

If your organization has currently implemented the Token Implicit Grant (Browser) option for OAuth authorization, then your organization is impacted. This deprecation also impacts the Embeddable Framework applications.

What do I need to do before the removal date?

Migrate your OAuth clients with Implicit Grant authorization to PKCE authorization.

• Starting May 25, 2026, the Token Implicit Grant (Browser) option will no longer be available for creating OAuth clients. However, existing OAuth clients that already use the implicit grant type authorization continue to work and can also be edited.
• Starting May 24, 2027, the Token Implicit Grant (Browser) option will be removed completely and no longer supported. For continuous functioning of authorization, all existing OAuth clients must be migrated to an alternate authorization option, for example, PKCE, before the effective date.

How can I prepare for this deprecation?

If you are an existing customer and implemented the Token Implicit Grant (Browser) option for OAuth authorization, you must update the authorization method to Genesys recommended PKCE authorization. Review the following supporting documentation before migrating to PKCE authorization:

• • OAuth 2.0 Security Best Practice
  • OAuth 2.0 for Browser-Based Apps
  • Grant – Proof Key for Code Exchange (PKCE) authorization

What if I need help or have questions?

Contact your Genesys account team. You can also visit Genesys Product Support for more assistance.