...
Access the Salesforce API Platform (sfap_api)
Access unique user identifiers (openid)
Manage user data via API (api)
Manage user data via Web Browsers (web)
Perform requests at any time (refresh_token, offline_access)
Check the following checkboxesRequire Proof Key for Code Exchange option needs to be unchecked.
The following options need to be checked:
Require Secret for Web Server Flow
Require Secret for Refresh Token Flow
Enable Client Credentials Flow
...