Hi @James Stall
Is your app a confidential client app? If it is a confidential client app, then the 'client_assertion' or 'client_secret' parameter is necessary during authorization.
On the contrary, if it is a public client app, then the 'client_assertion' or 'client_secret' parameter is not required. However, you need to enable the public client flow for the app.
Hope this helps.
If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.