Legacy Flows (Implicit and Hybrid)

OIDC Web still accepts the implicit (response_type=token / id_token) and hybrid (code id_token, etc.) response types for compatibility with older software.

Do not use these flows for new integrations. They return tokens directly in the redirect URL. Tokens in URLs are exposed to browser history, referrer headers, and logs. Use the Authorization Code flow with PKCE and sign your requests. This section exists only so maintainers of existing integrations understand why those response types still work.