This question is about a line from the OAuth2 rfc - https://tools.ietf.org/html/rfc6749
In Section 2.3, there is this line
The client MUST NOT use more than one authentication method in each request.
What exactly does this mean?
It's an error for the user to attempt to authenticate twice, e.g. via HTTP Basic Auth and then via Post. I believe that this is to avoid specifying what should be done if the user sends two different client_ids via two different authentication methods - rather than specifying which authentication takes precedence, it's simpler to forbid this scenario altogether