diff --git a/backend/app/main.py b/backend/app/main.py
index 1d815e8..0a67f3b 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -75,16 +75,21 @@ async def auth_callback(payload: AuthCallbackRequest):
 
     data = {
         "grant_type": "authorization_code",
-        "client_id": settings.oidc_client_id,
         "code": payload.code,
         "code_verifier": payload.code_verifier,
         "redirect_uri": str(payload.redirect_uri),
     }
+
+    # Some OIDC providers expect client credentials via HTTP Basic auth
+    auth = None
     if settings.oidc_client_secret:
-        data["client_secret"] = settings.oidc_client_secret
+        auth = (settings.oidc_client_id, settings.oidc_client_secret)
+    else:
+        # public client: include client_id in the request body
+        data["client_id"] = settings.oidc_client_id
 
     async with httpx.AsyncClient(timeout=15.0) as client:
-        response = await client.post(token_endpoint, data=data, headers={"Accept": "application/json"})
+        response = await client.post(token_endpoint, data=data, headers={"Accept": "application/json"}, auth=auth)
 
     if response.status_code != 200:
         raise HTTPException(status_code=400, detail=f"OIDC token exchange failed: {response.text}")