# Client authentication

Relying Parties (RP) must authenticate with BankID for server-to-server calls such as the [token](https://docs.stoe.no/bankid-oidc-provider/api/token.md) and [introspect](https://docs.stoe.no/bankid-oidc-provider/api/introspect.md) endpoints.

Among the [standardized authentication methods](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) the following is recommended:

- [`private_key_jwt`](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) in accordance with [standards](https://datatracker.ietf.org/doc/html/rfc7523). [Read more about this method](https://docs.stoe.no/bankid-oidc-provider/core-concepts/private-key-jwt.md).

We also support:

- [`client_secret_basic`](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) according to [OAuth2](https://tools.ietf.org/html/rfc6749#section-2.3.1) using the [HTTP Basic authentication](https://tools.ietf.org/html/rfc2617#section-2) scheme.
- [`client_secret_post`](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) according to [OAuth2](https://tools.ietf.org/html/rfc6749#section-2.3.1) by including the Client Credentials (`client_id` and `client_secret`) in the request body.

> **Info**
>
> In order to use `private_key_jwt` the merchant must send a request to BankID support with a public key to verify the signature as a [JSON Web Key Set (JWKS)](https://tools.ietf.org/html/rfc7517).
>
> Read more about the [requirements](https://docs.stoe.no/bankid-oidc-provider/core-concepts/private-key-jwt.md) here.