diff --git a/components/dashboard/src/dedicated-setup/SSOSetupStep.tsx b/components/dashboard/src/dedicated-setup/SSOSetupStep.tsx
index 335d01f62a1d5d..43e996ed69bed1 100644
--- a/components/dashboard/src/dedicated-setup/SSOSetupStep.tsx
+++ b/components/dashboard/src/dedicated-setup/SSOSetupStep.tsx
@@ -28,6 +28,7 @@ export const SSOSetupStep: FC<Props> = ({ config, onComplete, progressCurrent, p
         clientId: config?.oauth2Config?.clientId ?? "",
         clientSecret: config?.oauth2Config?.clientSecret ?? "",
         celExpression: config?.oauth2Config?.celExpression ?? "",
+        usePKCE: config?.oauth2Config?.usePkce ?? false,
     });
     const configIsValid = isValid(ssoConfig);
 
diff --git a/components/dashboard/src/teams/sso/OIDCClientConfigModal.tsx b/components/dashboard/src/teams/sso/OIDCClientConfigModal.tsx
index f8c85f0b239a1d..5dfe6106bc467a 100644
--- a/components/dashboard/src/teams/sso/OIDCClientConfigModal.tsx
+++ b/components/dashboard/src/teams/sso/OIDCClientConfigModal.tsx
@@ -27,6 +27,7 @@ export const OIDCClientConfigModal: FC<Props> = ({ clientConfig, onSaved, onClos
         clientId: clientConfig?.oauth2Config?.clientId ?? "",
         clientSecret: clientConfig?.oauth2Config?.clientSecret ?? "",
         celExpression: clientConfig?.oauth2Config?.celExpression ?? "",
+        usePKCE: clientConfig?.oauth2Config?.usePkce ?? false,
     });
     const configIsValid = isValid(ssoConfig);
 
diff --git a/components/dashboard/src/teams/sso/SSOConfigForm.tsx b/components/dashboard/src/teams/sso/SSOConfigForm.tsx
index bcf54118744f8d..18f89a993031c9 100644
--- a/components/dashboard/src/teams/sso/SSOConfigForm.tsx
+++ b/components/dashboard/src/teams/sso/SSOConfigForm.tsx
@@ -14,6 +14,7 @@ import isURL from "validator/lib/isURL";
 import { useCurrentOrg } from "../../data/organizations/orgs-query";
 import { useUpsertOIDCClientMutation } from "../../data/oidc-clients/upsert-oidc-client-mutation";
 import { Subheading } from "../../components/typography/headings";
+import { CheckboxInputField } from "../../components/forms/CheckboxInputField";
 
 type Props = {
     config: SSOConfig;
@@ -72,6 +73,13 @@ export const SSOConfigForm: FC<Props> = ({ config, readOnly = false, onChange })
                 onChange={(val) => onChange({ clientSecret: val })}
             />
 
+            <CheckboxInputField
+                label="Use PKCE"
+                checked={config.usePKCE}
+                disabled={readOnly}
+                onChange={(val) => onChange({ usePKCE: val })}
+            />
+
             <Subheading className="mt-8">
                 <strong>3.</strong> Restrict available accounts in your Identity Providers.
                 <a
@@ -103,6 +111,7 @@ export type SSOConfig = {
     clientId: string;
     clientSecret: string;
     celExpression?: string;
+    usePKCE: boolean;
 };
 
 export const ssoConfigReducer = (state: SSOConfig, action: Partial<SSOConfig>) => {
@@ -155,6 +164,7 @@ export const useSaveSSOConfig = () => {
                               clientId: trimmedClientId,
                               clientSecret: trimmedClientSecret,
                               celExpression: trimmedCelExpression,
+                              usePkce: ssoConfig.usePKCE,
                           },
                           oidcConfig: {
                               issuer: trimmedIssuer,
@@ -168,6 +178,7 @@ export const useSaveSSOConfig = () => {
                               // TODO: determine how we should handle when user doesn't change their secret
                               clientSecret: trimmedClientSecret.toLowerCase() === "redacted" ? "" : trimmedClientSecret,
                               celExpression: trimmedCelExpression,
+                              usePkce: ssoConfig.usePKCE,
                           },
                           oidcConfig: {
                               issuer: trimmedIssuer,
diff --git a/components/gitpod-db/go/oidc_client_config.go b/components/gitpod-db/go/oidc_client_config.go
index c31ad68aae1e68..2d5d53f63e81e9 100644
--- a/components/gitpod-db/go/oidc_client_config.go
+++ b/components/gitpod-db/go/oidc_client_config.go
@@ -60,6 +60,9 @@ type OIDCSpec struct {
 
 	// CelExpression is an optional expression that can be used to determine if the client should be allowed to authenticate.
 	CelExpression string `json:"celExpression"`
+
+	// UsePKCE specifies if the client should use PKCE for the OAuth flow.
+	UsePKCE bool `json:"usePKCE"`
 }
 
 func CreateOIDCClientConfig(ctx context.Context, conn *gorm.DB, cfg OIDCClientConfig) (OIDCClientConfig, error) {
@@ -352,6 +355,7 @@ func partialUpdateOIDCSpec(old, new OIDCSpec) OIDCSpec {
 	}
 
 	old.CelExpression = new.CelExpression
+	old.UsePKCE = new.UsePKCE
 
 	if !oidcScopesEqual(old.Scopes, new.Scopes) {
 		old.Scopes = new.Scopes
diff --git a/components/public-api-server/go.mod b/components/public-api-server/go.mod
index 0d353707cba0c1..d9994ecfa84191 100644
--- a/components/public-api-server/go.mod
+++ b/components/public-api-server/go.mod
@@ -29,7 +29,7 @@ require (
 	github.com/stretchr/testify v1.8.4
 	github.com/stripe/stripe-go/v72 v72.122.0
 	github.com/zitadel/oidc v1.13.0
-	golang.org/x/oauth2 v0.7.0
+	golang.org/x/oauth2 v0.22.0
 	google.golang.org/grpc v1.57.0
 	google.golang.org/protobuf v1.33.0
 	gopkg.in/square/go-jose.v2 v2.6.0
diff --git a/components/public-api-server/go.sum b/components/public-api-server/go.sum
index 47275f658f5303..332a9cfad5fe0a 100644
--- a/components/public-api-server/go.sum
+++ b/components/public-api-server/go.sum
@@ -509,6 +509,8 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.3.0/go.mod h1:rQrIauxkUhJ6CuwEXwymO2/eh4xz2ZWF1nBkcxS+tGk=
 golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
 golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
+golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
+golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
diff --git a/components/public-api-server/pkg/apiv1/oidc.go b/components/public-api-server/pkg/apiv1/oidc.go
index e0082b233348dd..3ee2555e896b62 100644
--- a/components/public-api-server/pkg/apiv1/oidc.go
+++ b/components/public-api-server/pkg/apiv1/oidc.go
@@ -443,6 +443,7 @@ func dbOIDCClientConfigToAPI(config db.OIDCClientConfig, decryptor db.Decryptor)
 			AuthorizationEndpoint: decrypted.RedirectURL,
 			Scopes:                decrypted.Scopes,
 			CelExpression:         decrypted.CelExpression,
+			UsePkce:               decrypted.UsePKCE,
 		},
 		OidcConfig: &v1.OIDCConfig{
 			Issuer: config.Issuer,
@@ -472,6 +473,7 @@ func toDbOIDCSpec(oauth2Config *v1.OAuth2Config) db.OIDCSpec {
 		ClientID:      oauth2Config.GetClientId(),
 		ClientSecret:  oauth2Config.GetClientSecret(),
 		CelExpression: oauth2Config.GetCelExpression(),
+		UsePKCE:       oauth2Config.GetUsePkce(),
 		RedirectURL:   oauth2Config.GetAuthorizationEndpoint(),
 		Scopes:        append([]string{goidc.ScopeOpenID, "profile", "email"}, oauth2Config.GetScopes()...),
 	}
diff --git a/components/public-api-server/pkg/oidc/oauth2.go b/components/public-api-server/pkg/oidc/oauth2.go
index cd61925bc5c01e..f39ee278d99827 100644
--- a/components/public-api-server/pkg/oidc/oauth2.go
+++ b/components/public-api-server/pkg/oidc/oauth2.go
@@ -84,8 +84,18 @@ func (s *Service) OAuth2Middleware(next http.Handler) http.Handler {
 			return
 		}
 
+		opts := []oauth2.AuthCodeOption{}
+		if config.UsePKCE {
+			codeVerifier, err := r.Cookie(verifierCookieName)
+			if err != nil {
+				http.Error(rw, "code_verifier cookie not found", http.StatusBadRequest)
+				return
+			}
+			opts = append(opts, oauth2.VerifierOption(codeVerifier.Value))
+		}
+
 		config.OAuth2Config.RedirectURL = getCallbackURL(r.Host)
-		oauth2Token, err := config.OAuth2Config.Exchange(r.Context(), code)
+		oauth2Token, err := config.OAuth2Config.Exchange(r.Context(), code, opts...)
 		if err != nil {
 			log.WithError(err).Warn("Failed to exchange OAuth2 token.")
 			respondeWithError(rw, r, "Failed to exchange OAuth2 token: "+err.Error(), http.StatusInternalServerError, useHttpErrors)
diff --git a/components/public-api-server/pkg/oidc/router.go b/components/public-api-server/pkg/oidc/router.go
index 08b21e26cb2414..b79092b7f82ba0 100644
--- a/components/public-api-server/pkg/oidc/router.go
+++ b/components/public-api-server/pkg/oidc/router.go
@@ -32,8 +32,9 @@ func Router(s *Service) *chi.Mux {
 }
 
 const (
-	stateCookieName = "state"
-	nonceCookieName = "nonce"
+	stateCookieName    = "state"
+	nonceCookieName    = "nonce"
+	verifierCookieName = "verifier"
 )
 
 func (s *Service) getStartHandler() http.HandlerFunc {
@@ -83,6 +84,7 @@ func (s *Service) getStartHandler() http.HandlerFunc {
 
 		http.SetCookie(rw, newCallbackCookie(r, nonceCookieName, startParams.Nonce))
 		http.SetCookie(rw, newCallbackCookie(r, stateCookieName, startParams.State))
+		http.SetCookie(rw, newCallbackCookie(r, verifierCookieName, startParams.CodeVerifier))
 
 		http.Redirect(rw, r, startParams.AuthCodeURL, http.StatusTemporaryRedirect)
 	}
diff --git a/components/public-api-server/pkg/oidc/service.go b/components/public-api-server/pkg/oidc/service.go
index a96815845db66f..6fbaf7a87443d1 100644
--- a/components/public-api-server/pkg/oidc/service.go
+++ b/components/public-api-server/pkg/oidc/service.go
@@ -52,12 +52,14 @@ type ClientConfig struct {
 	OAuth2Config   *oauth2.Config
 	VerifierConfig *goidc.Config
 	CelExpression  string
+	UsePKCE        bool
 }
 
 type StartParams struct {
-	State       string
-	Nonce       string
-	AuthCodeURL string
+	State        string
+	Nonce        string
+	CodeVerifier string
+	AuthCodeURL  string
 }
 
 type AuthFlowResult struct {
@@ -92,12 +94,21 @@ func (s *Service) getStartParams(config *ClientConfig, redirectURL string, state
 
 	// Configuring `AuthCodeOption`s, e.g. nonce
 	config.OAuth2Config.RedirectURL = redirectURL
-	authCodeURL := config.OAuth2Config.AuthCodeURL(state, goidc.Nonce(nonce))
+
+	opts := []oauth2.AuthCodeOption{goidc.Nonce(nonce)}
+	var verifier string
+	if config.UsePKCE {
+		verifier = oauth2.GenerateVerifier()
+		opts = append(opts, oauth2.S256ChallengeOption(verifier))
+	}
+
+	authCodeURL := config.OAuth2Config.AuthCodeURL(state, opts...)
 
 	return &StartParams{
-		AuthCodeURL: authCodeURL,
-		State:       state,
-		Nonce:       nonce,
+		AuthCodeURL:  authCodeURL,
+		State:        state,
+		Nonce:        nonce,
+		CodeVerifier: verifier,
 	}, nil
 }
 
@@ -252,6 +263,7 @@ func (s *Service) convertClientConfig(ctx context.Context, dbEntry db.OIDCClient
 			Scopes:       spec.Scopes,
 		},
 		CelExpression: spec.CelExpression,
+		UsePKCE:       spec.UsePKCE,
 		VerifierConfig: &goidc.Config{
 			ClientID: spec.ClientID,
 		},
diff --git a/components/public-api/gitpod/experimental/v1/oidc.proto b/components/public-api/gitpod/experimental/v1/oidc.proto
index 66b2b002f9976f..43d210bf61ef1c 100644
--- a/components/public-api/gitpod/experimental/v1/oidc.proto
+++ b/components/public-api/gitpod/experimental/v1/oidc.proto
@@ -121,6 +121,9 @@ message OAuth2Config {
   // CEL expression to verify a profile.
   // Optional.
   string cel_expression = 9;
+
+  // Use PKCE for the OAuth2 flow.
+  bool use_pkce = 10;
 }
 
 // Description of keys of a userinfo result.
diff --git a/components/public-api/go/experimental/v1/oidc.pb.go b/components/public-api/go/experimental/v1/oidc.pb.go
index 24c082bab12f4e..8206f2c1e238c4 100644
--- a/components/public-api/go/experimental/v1/oidc.pb.go
+++ b/components/public-api/go/experimental/v1/oidc.pb.go
@@ -418,6 +418,8 @@ type OAuth2Config struct {
 	// CEL expression to verify a profile.
 	// Optional.
 	CelExpression string `protobuf:"bytes,9,opt,name=cel_expression,json=celExpression,proto3" json:"cel_expression,omitempty"`
+	// Use PKCE for the OAuth2 flow.
+	UsePkce bool `protobuf:"varint,10,opt,name=use_pkce,json=usePkce,proto3" json:"use_pkce,omitempty"`
 }
 
 func (x *OAuth2Config) Reset() {
@@ -508,6 +510,13 @@ func (x *OAuth2Config) GetCelExpression() string {
 	return ""
 }
 
+func (x *OAuth2Config) GetUsePkce() bool {
+	if x != nil {
+		return x.UsePkce
+	}
+	return false
+}
+
 // Description of keys of a userinfo result.
 type UserInfoKeys struct {
 	state         protoimpl.MessageState
@@ -1276,7 +1285,7 @@ var file_gitpod_experimental_v1_oidc_proto_rawDesc = []byte{
 	0x70, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x5f, 0x75,
 	0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x10, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
-	0x4b, 0x65, 0x79, 0x22, 0xe5, 0x02, 0x0a, 0x0c, 0x4f, 0x41, 0x75, 0x74, 0x68, 0x32, 0x43, 0x6f,
+	0x4b, 0x65, 0x79, 0x22, 0x80, 0x03, 0x0a, 0x0c, 0x4f, 0x41, 0x75, 0x74, 0x68, 0x32, 0x43, 0x6f,
 	0x6e, 0x66, 0x69, 0x67, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69,
 	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49,
 	0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x63, 0x72,
@@ -1298,140 +1307,141 @@ var file_gitpod_experimental_v1_oidc_proto_rawDesc = []byte{
 	0x66, 0x6f, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x0c, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f,
 	0x4b, 0x65, 0x79, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x65, 0x6c, 0x5f, 0x65, 0x78, 0x70, 0x72,
 	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x63, 0x65,
-	0x6c, 0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x62, 0x0a, 0x0c, 0x55,
-	0x73, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x75,
-	0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x5f, 0x69, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x49, 0x64,
-	0x4b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x11, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f,
-	0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x4e, 0x61, 0x6d, 0x65, 0x4b, 0x65, 0x79, 0x22,
-	0x18, 0x0a, 0x16, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x82, 0x01, 0x0a, 0x19, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x6c, 0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x75,
+	0x73, 0x65, 0x5f, 0x70, 0x6b, 0x63, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x75,
+	0x73, 0x65, 0x50, 0x6b, 0x63, 0x65, 0x22, 0x62, 0x0a, 0x0c, 0x55, 0x73, 0x65, 0x72, 0x49, 0x6e,
+	0x66, 0x6f, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e,
+	0x66, 0x6f, 0x5f, 0x69, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0d, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x49, 0x64, 0x4b, 0x65, 0x79, 0x12, 0x2a,
+	0x0a, 0x11, 0x75, 0x73, 0x65, 0x72, 0x69, 0x6e, 0x66, 0x6f, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f,
+	0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x75, 0x73, 0x65, 0x72, 0x69,
+	0x6e, 0x66, 0x6f, 0x4e, 0x61, 0x6d, 0x65, 0x4b, 0x65, 0x79, 0x22, 0x18, 0x0a, 0x16, 0x4f, 0x49,
+	0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x22, 0x82, 0x01, 0x0a, 0x19, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
+	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x49, 0x44, 0x43,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x5f, 0x64, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x75, 0x73, 0x65,
+	0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x22, 0x5e, 0x0a, 0x1a, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
 	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64,
 	0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31,
 	0x2e, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x75, 0x73, 0x65,
-	0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0c, 0x75, 0x73, 0x65, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x22, 0x5e,
-	0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67,
-	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x51,
-	0x0a, 0x16, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x6f, 0x72, 0x67, 0x61,
-	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49,
-	0x64, 0x22, 0x5b, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67,
-	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
-	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x87,
-	0x01, 0x0a, 0x18, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x6f,
-	0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x49, 0x64, 0x12, 0x42, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
-	0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
-	0x31, 0x2e, 0x50, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x70, 0x61,
-	0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x91, 0x01, 0x0a, 0x19, 0x4c, 0x69, 0x73,
-	0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28,
-	0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65,
-	0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x74, 0x61, 0x6c,
-	0x5f, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c,
-	0x74, 0x6f, 0x74, 0x61, 0x6c, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x22, 0x5d, 0x0a, 0x19,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70,
+	0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x51, 0x0a, 0x16, 0x47, 0x65, 0x74,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6f, 0x72,
+	0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0x5b, 0x0a, 0x17,
+	0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64,
+	0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31,
+	0x2e, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x87, 0x01, 0x0a, 0x18, 0x4c, 0x69,
+	0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69,
+	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
+	0x42, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70,
+	0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x67,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x22, 0x91, 0x01, 0x0a, 0x19, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x4f, 0x0a, 0x0e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70,
 	0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e,
 	0x76, 0x31, 0x2e, 0x4f, 0x49, 0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x1c, 0x0a, 0x1a, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x54, 0x0a, 0x19, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69,
-	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22,
-	0x1c, 0x0a, 0x1a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x77, 0x0a,
-	0x20, 0x53, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x66, 0x69, 0x67, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x73, 0x75,
+	0x6c, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x74, 0x6f, 0x74, 0x61, 0x6c,
+	0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x22, 0x5d, 0x0a, 0x19, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78,
+	0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x49,
+	0x44, 0x43, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x1c, 0x0a, 0x1a, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x54, 0x0a, 0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
 	0x64, 0x12, 0x27, 0x0a, 0x0f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
 	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6f, 0x72, 0x67, 0x61,
-	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x63,
-	0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x61, 0x63,
-	0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x23, 0x0a, 0x21, 0x53, 0x65, 0x74, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x91, 0x06, 0x0a, 0x0b,
-	0x4f, 0x49, 0x44, 0x43, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7d, 0x0a, 0x12, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x31, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72,
-	0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78,
-	0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x74, 0x0a, 0x0f, 0x47, 0x65,
-	0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2e, 0x2e,
-	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e,
-	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x7a, 0x0a, 0x11, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x73, 0x12, 0x30, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
-	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64,
-	0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7d, 0x0a, 0x12,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x31, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
-	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65,
-	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7d, 0x0a, 0x12, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x31, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72,
-	0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78,
-	0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
+	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x22, 0x1c, 0x0a, 0x1a, 0x44, 0x65,
 	0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x92, 0x01, 0x0a, 0x19, 0x53,
-	0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x63,
-	0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x38, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
-	0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
-	0x31, 0x2e, 0x53, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x39, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
-	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x43,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x77, 0x0a, 0x20, 0x53, 0x65, 0x74, 0x43,
 	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x63, 0x74, 0x69, 0x76,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42,
-	0x6b, 0x0a, 0x23, 0x69, 0x6f, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x61, 0x70, 0x69, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
-	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x5a, 0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2d, 0x69, 0x6f, 0x2f, 0x67, 0x69, 0x74,
-	0x70, 0x6f, 0x64, 0x2f, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x2d, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x6f, 0x2f, 0x65, 0x78, 0x70,
-	0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x27, 0x0a, 0x0f,
+	0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x22, 0x23, 0x0a, 0x21, 0x53, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x91, 0x06, 0x0a, 0x0b, 0x4f, 0x49, 0x44, 0x43, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7d, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x31, 0x2e, 0x67,
+	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
+	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x32, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
+	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x74, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2e, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
+	0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f,
+	0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7a, 0x0a, 0x11, 0x4c,
+	0x69, 0x73, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73,
+	0x12, 0x30, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69,
+	0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x31, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65,
+	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7d, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x31, 0x2e,
+	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
+	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x32, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69,
+	0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7d, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x31, 0x2e, 0x67,
+	0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
+	0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x32, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d,
+	0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x92, 0x01, 0x0a, 0x19, 0x53, 0x65, 0x74, 0x43, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x38, 0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70,
+	0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x63, 0x74, 0x69,
+	0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x39, 0x2e,
+	0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e,
+	0x74, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x6b, 0x0a, 0x23, 0x69, 0x6f,
+	0x2e, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2e, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x61, 0x70,
+	0x69, 0x2e, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x6c, 0x2e, 0x76,
+	0x31, 0x5a, 0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69,
+	0x74, 0x70, 0x6f, 0x64, 0x2d, 0x69, 0x6f, 0x2f, 0x67, 0x69, 0x74, 0x70, 0x6f, 0x64, 0x2f, 0x63,
+	0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x2d, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x6f, 0x2f, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65,
+	0x6e, 0x74, 0x61, 0x6c, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/components/public-api/java/src/main/java/io/gitpod/publicapi/experimental/v1/Oidc.java b/components/public-api/java/src/main/java/io/gitpod/publicapi/experimental/v1/Oidc.java
index f2717554d10788..796474aeac08f4 100644
--- a/components/public-api/java/src/main/java/io/gitpod/publicapi/experimental/v1/Oidc.java
+++ b/components/public-api/java/src/main/java/io/gitpod/publicapi/experimental/v1/Oidc.java
@@ -5886,6 +5886,16 @@ public interface OAuth2ConfigOrBuilder extends
      */
     com.google.protobuf.ByteString
         getCelExpressionBytes();
+
+    /**
+     * <pre>
+     * Use PKCE for the OAuth2 flow.
+     * </pre>
+     *
+     * <code>bool use_pkce = 10 [json_name = "usePkce"];</code>
+     * @return The usePkce.
+     */
+    boolean getUsePkce();
   }
   /**
    * <pre>
@@ -6321,6 +6331,21 @@ public java.lang.String getCelExpression() {
       }
     }
 
+    public static final int USE_PKCE_FIELD_NUMBER = 10;
+    private boolean usePkce_ = false;
+    /**
+     * <pre>
+     * Use PKCE for the OAuth2 flow.
+     * </pre>
+     *
+     * <code>bool use_pkce = 10 [json_name = "usePkce"];</code>
+     * @return The usePkce.
+     */
+    @java.lang.Override
+    public boolean getUsePkce() {
+      return usePkce_;
+    }
+
     private byte memoizedIsInitialized = -1;
     @java.lang.Override
     public final boolean isInitialized() {
@@ -6359,6 +6384,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output)
       if (!com.google.protobuf.GeneratedMessage.isStringEmpty(celExpression_)) {
         com.google.protobuf.GeneratedMessage.writeString(output, 9, celExpression_);
       }
+      if (usePkce_ != false) {
+        output.writeBool(10, usePkce_);
+      }
       getUnknownFields().writeTo(output);
     }
 
@@ -6398,6 +6426,10 @@ public int getSerializedSize() {
       if (!com.google.protobuf.GeneratedMessage.isStringEmpty(celExpression_)) {
         size += com.google.protobuf.GeneratedMessage.computeStringSize(9, celExpression_);
       }
+      if (usePkce_ != false) {
+        size += com.google.protobuf.CodedOutputStream
+          .computeBoolSize(10, usePkce_);
+      }
       size += getUnknownFields().getSerializedSize();
       memoizedSize = size;
       return size;
@@ -6432,6 +6464,8 @@ public boolean equals(final java.lang.Object obj) {
       }
       if (!getCelExpression()
           .equals(other.getCelExpression())) return false;
+      if (getUsePkce()
+          != other.getUsePkce()) return false;
       if (!getUnknownFields().equals(other.getUnknownFields())) return false;
       return true;
     }
@@ -6463,6 +6497,9 @@ public int hashCode() {
       }
       hash = (37 * hash) + CEL_EXPRESSION_FIELD_NUMBER;
       hash = (53 * hash) + getCelExpression().hashCode();
+      hash = (37 * hash) + USE_PKCE_FIELD_NUMBER;
+      hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(
+          getUsePkce());
       hash = (29 * hash) + getUnknownFields().hashCode();
       memoizedHashCode = hash;
       return hash;
@@ -6617,6 +6654,7 @@ public Builder clear() {
           userinfoKeysBuilder_ = null;
         }
         celExpression_ = "";
+        usePkce_ = false;
         return this;
       }
 
@@ -6679,6 +6717,9 @@ private void buildPartial0(io.gitpod.publicapi.experimental.v1.Oidc.OAuth2Config
         if (((from_bitField0_ & 0x00000080) != 0)) {
           result.celExpression_ = celExpression_;
         }
+        if (((from_bitField0_ & 0x00000100) != 0)) {
+          result.usePkce_ = usePkce_;
+        }
         result.bitField0_ |= to_bitField0_;
       }
 
@@ -6737,6 +6778,9 @@ public Builder mergeFrom(io.gitpod.publicapi.experimental.v1.Oidc.OAuth2Config o
           bitField0_ |= 0x00000080;
           onChanged();
         }
+        if (other.getUsePkce() != false) {
+          setUsePkce(other.getUsePkce());
+        }
         this.mergeUnknownFields(other.getUnknownFields());
         onChanged();
         return this;
@@ -6806,6 +6850,11 @@ public Builder mergeFrom(
                 bitField0_ |= 0x00000080;
                 break;
               } // case 74
+              case 80: {
+                usePkce_ = input.readBool();
+                bitField0_ |= 0x00000100;
+                break;
+              } // case 80
               default: {
                 if (!super.parseUnknownField(input, extensionRegistry, tag)) {
                   done = true; // was an endgroup tag
@@ -7708,6 +7757,50 @@ public Builder setCelExpressionBytes(
         return this;
       }
 
+      private boolean usePkce_ ;
+      /**
+       * <pre>
+       * Use PKCE for the OAuth2 flow.
+       * </pre>
+       *
+       * <code>bool use_pkce = 10 [json_name = "usePkce"];</code>
+       * @return The usePkce.
+       */
+      @java.lang.Override
+      public boolean getUsePkce() {
+        return usePkce_;
+      }
+      /**
+       * <pre>
+       * Use PKCE for the OAuth2 flow.
+       * </pre>
+       *
+       * <code>bool use_pkce = 10 [json_name = "usePkce"];</code>
+       * @param value The usePkce to set.
+       * @return This builder for chaining.
+       */
+      public Builder setUsePkce(boolean value) {
+
+        usePkce_ = value;
+        bitField0_ |= 0x00000100;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * Use PKCE for the OAuth2 flow.
+       * </pre>
+       *
+       * <code>bool use_pkce = 10 [json_name = "usePkce"];</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearUsePkce() {
+        bitField0_ = (bitField0_ & ~0x00000100);
+        usePkce_ = false;
+        onChanged();
+        return this;
+      }
+
       // @@protoc_insertion_point(builder_scope:gitpod.experimental.v1.OAuth2Config)
     }
 
@@ -16069,7 +16162,7 @@ public io.gitpod.publicapi.experimental.v1.Oidc.SetClientConfigActivationRespons
       "ide\022&\n\017claim_email_key\030\001 \001(\tR\rclaimEmail" +
       "Key\022(\n\020claim_groups_key\030\002 \001(\tR\016claimGrou" +
       "psKey\022,\n\022claim_username_key\030\003 \001(\tR\020claim" +
-      "UsernameKey\"\345\002\n\014OAuth2Config\022\033\n\tclient_i" +
+      "UsernameKey\"\200\003\n\014OAuth2Config\022\033\n\tclient_i" +
       "d\030\001 \001(\tR\010clientId\022#\n\rclient_secret\030\002 \001(\t" +
       "R\014clientSecret\0225\n\026authorization_endpoint" +
       "\030\003 \001(\tR\025authorizationEndpoint\022%\n\016token_e" +
@@ -16078,60 +16171,60 @@ public io.gitpod.publicapi.experimental.v1.Oidc.SetClientConfigActivationRespons
       "\020userinfoEndpoint\022I\n\ruserinfo_keys\030\007 \001(\013" +
       "2$.gitpod.experimental.v1.UserInfoKeysR\014" +
       "userinfoKeys\022%\n\016cel_expression\030\t \001(\tR\rce" +
-      "lExpression\"b\n\014UserInfoKeys\022&\n\017userinfo_" +
-      "id_key\030\001 \001(\tR\ruserinfoIdKey\022*\n\021userinfo_" +
-      "name_key\030\002 \001(\tR\017userinfoNameKey\"\030\n\026OIDCC" +
-      "lientConfigStatus\"\202\001\n\031CreateClientConfig" +
-      "Request\022@\n\006config\030\001 \001(\0132(.gitpod.experim" +
-      "ental.v1.OIDCClientConfigR\006config\022#\n\ruse" +
-      "_discovery\030\002 \001(\010R\014useDiscovery\"^\n\032Create" +
-      "ClientConfigResponse\022@\n\006config\030\001 \001(\0132(.g" +
-      "itpod.experimental.v1.OIDCClientConfigR\006" +
-      "config\"Q\n\026GetClientConfigRequest\022\016\n\002id\030\001" +
-      " \001(\tR\002id\022\'\n\017organization_id\030\002 \001(\tR\016organ" +
-      "izationId\"[\n\027GetClientConfigResponse\022@\n\006" +
-      "config\030\001 \001(\0132(.gitpod.experimental.v1.OI" +
-      "DCClientConfigR\006config\"\207\001\n\030ListClientCon" +
-      "figsRequest\022\'\n\017organization_id\030\001 \001(\tR\016or" +
-      "ganizationId\022B\n\npagination\030\002 \001(\0132\".gitpo" +
-      "d.experimental.v1.PaginationR\npagination" +
-      "\"\221\001\n\031ListClientConfigsResponse\022O\n\016client" +
-      "_configs\030\001 \003(\0132(.gitpod.experimental.v1." +
-      "OIDCClientConfigR\rclientConfigs\022#\n\rtotal" +
-      "_results\030\002 \001(\003R\014totalResults\"]\n\031UpdateCl" +
-      "ientConfigRequest\022@\n\006config\030\001 \001(\0132(.gitp" +
-      "od.experimental.v1.OIDCClientConfigR\006con" +
-      "fig\"\034\n\032UpdateClientConfigResponse\"T\n\031Del" +
-      "eteClientConfigRequest\022\016\n\002id\030\001 \001(\tR\002id\022\'" +
-      "\n\017organization_id\030\002 \001(\tR\016organizationId\"" +
-      "\034\n\032DeleteClientConfigResponse\"w\n SetClie" +
-      "ntConfigActivationRequest\022\016\n\002id\030\001 \001(\tR\002i" +
-      "d\022\'\n\017organization_id\030\002 \001(\tR\016organization" +
-      "Id\022\032\n\010activate\030\003 \001(\010R\010activate\"#\n!SetCli" +
-      "entConfigActivationResponse2\221\006\n\013OIDCServ" +
-      "ice\022}\n\022CreateClientConfig\0221.gitpod.exper" +
-      "imental.v1.CreateClientConfigRequest\0322.g" +
-      "itpod.experimental.v1.CreateClientConfig" +
-      "Response\"\000\022t\n\017GetClientConfig\022..gitpod.e" +
-      "xperimental.v1.GetClientConfigRequest\032/." +
-      "gitpod.experimental.v1.GetClientConfigRe" +
-      "sponse\"\000\022z\n\021ListClientConfigs\0220.gitpod.e" +
-      "xperimental.v1.ListClientConfigsRequest\032" +
-      "1.gitpod.experimental.v1.ListClientConfi" +
-      "gsResponse\"\000\022}\n\022UpdateClientConfig\0221.git" +
-      "pod.experimental.v1.UpdateClientConfigRe" +
-      "quest\0322.gitpod.experimental.v1.UpdateCli" +
-      "entConfigResponse\"\000\022}\n\022DeleteClientConfi" +
-      "g\0221.gitpod.experimental.v1.DeleteClientC" +
-      "onfigRequest\0322.gitpod.experimental.v1.De" +
-      "leteClientConfigResponse\"\000\022\222\001\n\031SetClient" +
-      "ConfigActivation\0228.gitpod.experimental.v" +
-      "1.SetClientConfigActivationRequest\0329.git" +
-      "pod.experimental.v1.SetClientConfigActiv" +
-      "ationResponse\"\000Bk\n#io.gitpod.publicapi.e" +
-      "xperimental.v1ZDgithub.com/gitpod-io/git" +
-      "pod/components/public-api/go/experimenta" +
-      "l/v1b\006proto3"
+      "lExpression\022\031\n\010use_pkce\030\n \001(\010R\007usePkce\"b" +
+      "\n\014UserInfoKeys\022&\n\017userinfo_id_key\030\001 \001(\tR" +
+      "\ruserinfoIdKey\022*\n\021userinfo_name_key\030\002 \001(" +
+      "\tR\017userinfoNameKey\"\030\n\026OIDCClientConfigSt" +
+      "atus\"\202\001\n\031CreateClientConfigRequest\022@\n\006co" +
+      "nfig\030\001 \001(\0132(.gitpod.experimental.v1.OIDC" +
+      "ClientConfigR\006config\022#\n\ruse_discovery\030\002 " +
+      "\001(\010R\014useDiscovery\"^\n\032CreateClientConfigR" +
+      "esponse\022@\n\006config\030\001 \001(\0132(.gitpod.experim" +
+      "ental.v1.OIDCClientConfigR\006config\"Q\n\026Get" +
+      "ClientConfigRequest\022\016\n\002id\030\001 \001(\tR\002id\022\'\n\017o" +
+      "rganization_id\030\002 \001(\tR\016organizationId\"[\n\027" +
+      "GetClientConfigResponse\022@\n\006config\030\001 \001(\0132" +
+      "(.gitpod.experimental.v1.OIDCClientConfi" +
+      "gR\006config\"\207\001\n\030ListClientConfigsRequest\022\'" +
+      "\n\017organization_id\030\001 \001(\tR\016organizationId\022" +
+      "B\n\npagination\030\002 \001(\0132\".gitpod.experimenta" +
+      "l.v1.PaginationR\npagination\"\221\001\n\031ListClie" +
+      "ntConfigsResponse\022O\n\016client_configs\030\001 \003(" +
+      "\0132(.gitpod.experimental.v1.OIDCClientCon" +
+      "figR\rclientConfigs\022#\n\rtotal_results\030\002 \001(" +
+      "\003R\014totalResults\"]\n\031UpdateClientConfigReq" +
+      "uest\022@\n\006config\030\001 \001(\0132(.gitpod.experiment" +
+      "al.v1.OIDCClientConfigR\006config\"\034\n\032Update" +
+      "ClientConfigResponse\"T\n\031DeleteClientConf" +
+      "igRequest\022\016\n\002id\030\001 \001(\tR\002id\022\'\n\017organizatio" +
+      "n_id\030\002 \001(\tR\016organizationId\"\034\n\032DeleteClie" +
+      "ntConfigResponse\"w\n SetClientConfigActiv" +
+      "ationRequest\022\016\n\002id\030\001 \001(\tR\002id\022\'\n\017organiza" +
+      "tion_id\030\002 \001(\tR\016organizationId\022\032\n\010activat" +
+      "e\030\003 \001(\010R\010activate\"#\n!SetClientConfigActi" +
+      "vationResponse2\221\006\n\013OIDCService\022}\n\022Create" +
+      "ClientConfig\0221.gitpod.experimental.v1.Cr" +
+      "eateClientConfigRequest\0322.gitpod.experim" +
+      "ental.v1.CreateClientConfigResponse\"\000\022t\n" +
+      "\017GetClientConfig\022..gitpod.experimental.v" +
+      "1.GetClientConfigRequest\032/.gitpod.experi" +
+      "mental.v1.GetClientConfigResponse\"\000\022z\n\021L" +
+      "istClientConfigs\0220.gitpod.experimental.v" +
+      "1.ListClientConfigsRequest\0321.gitpod.expe" +
+      "rimental.v1.ListClientConfigsResponse\"\000\022" +
+      "}\n\022UpdateClientConfig\0221.gitpod.experimen" +
+      "tal.v1.UpdateClientConfigRequest\0322.gitpo" +
+      "d.experimental.v1.UpdateClientConfigResp" +
+      "onse\"\000\022}\n\022DeleteClientConfig\0221.gitpod.ex" +
+      "perimental.v1.DeleteClientConfigRequest\032" +
+      "2.gitpod.experimental.v1.DeleteClientCon" +
+      "figResponse\"\000\022\222\001\n\031SetClientConfigActivat" +
+      "ion\0228.gitpod.experimental.v1.SetClientCo" +
+      "nfigActivationRequest\0329.gitpod.experimen" +
+      "tal.v1.SetClientConfigActivationResponse" +
+      "\"\000Bk\n#io.gitpod.publicapi.experimental.v" +
+      "1ZDgithub.com/gitpod-io/gitpod/component" +
+      "s/public-api/go/experimental/v1b\006proto3"
     };
     descriptor = com.google.protobuf.Descriptors.FileDescriptor
       .internalBuildGeneratedFileFrom(descriptorData,
@@ -16168,7 +16261,7 @@ public io.gitpod.publicapi.experimental.v1.Oidc.SetClientConfigActivationRespons
     internal_static_gitpod_experimental_v1_OAuth2Config_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessage.FieldAccessorTable(
         internal_static_gitpod_experimental_v1_OAuth2Config_descriptor,
-        new java.lang.String[] { "ClientId", "ClientSecret", "AuthorizationEndpoint", "TokenEndpoint", "Scopes", "UserinfoEndpoint", "UserinfoKeys", "CelExpression", });
+        new java.lang.String[] { "ClientId", "ClientSecret", "AuthorizationEndpoint", "TokenEndpoint", "Scopes", "UserinfoEndpoint", "UserinfoKeys", "CelExpression", "UsePkce", });
     internal_static_gitpod_experimental_v1_UserInfoKeys_descriptor =
       getDescriptor().getMessageTypes().get(5);
     internal_static_gitpod_experimental_v1_UserInfoKeys_fieldAccessorTable = new
diff --git a/components/public-api/typescript/src/gitpod/experimental/v1/oidc_pb.ts b/components/public-api/typescript/src/gitpod/experimental/v1/oidc_pb.ts
index bdc9d0ddcf233e..2a14ad8d2cae70 100644
--- a/components/public-api/typescript/src/gitpod/experimental/v1/oidc_pb.ts
+++ b/components/public-api/typescript/src/gitpod/experimental/v1/oidc_pb.ts
@@ -9,7 +9,14 @@
 /* eslint-disable */
 // @ts-nocheck
 
-import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import type {
+    BinaryReadOptions,
+    FieldList,
+    JsonReadOptions,
+    JsonValue,
+    PartialMessage,
+    PlainMessage,
+} from "@bufbuild/protobuf";
 import { Message, proto3, protoInt64, Timestamp } from "@bufbuild/protobuf";
 import { Pagination } from "./pagination_pb.js";
 
@@ -22,115 +29,124 @@ import { Pagination } from "./pagination_pb.js";
  * @generated from message gitpod.experimental.v1.OIDCClientConfig
  */
 export class OIDCClientConfig extends Message<OIDCClientConfig> {
-  /**
-   * ID is the unique identifier for the OIDC Config.
-   * Read only.
-   *
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string organization_id = 2;
-   */
-  organizationId = "";
-
-  /**
-   * @generated from field: gitpod.experimental.v1.OIDCConfig oidc_config = 3;
-   */
-  oidcConfig?: OIDCConfig;
-
-  /**
-   * @generated from field: gitpod.experimental.v1.OAuth2Config oauth2_config = 4;
-   */
-  oauth2Config?: OAuth2Config;
-
-  /**
-   * Optional.
-   *
-   * @generated from field: bool oauth_only = 5;
-   */
-  oauthOnly = false;
-
-  /**
-   * List of the JWS signing algorithms (alg values) supported by the OP for the
-   * ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be
-   * included.
-   * Optional.
-   *
-   * @generated from field: repeated string id_token_signing_alg_values_supported = 6;
-   */
-  idTokenSigningAlgValuesSupported: string[] = [];
-
-  /**
-   * Time when the config was created.
-   * Read-only.
-   *
-   * @generated from field: google.protobuf.Timestamp creation_time = 7;
-   */
-  creationTime?: Timestamp;
-
-  /**
-   * Describes the status of this configuration item.
-   * Read-only.
-   *
-   * @generated from field: gitpod.experimental.v1.OIDCClientConfigStatus status = 8;
-   */
-  status?: OIDCClientConfigStatus;
-
-  /**
-   * Whether this config can be used for sign-ins.
-   * Defaults to false.
-   * Optional.
-   *
-   * @generated from field: bool active = 9;
-   */
-  active = false;
-
-  /**
-   * Whether this config was tested by executing the OIDC flow.
-   * Defaults to false.
-   * Optional.
-   *
-   * @generated from field: bool verified = 10;
-   */
-  verified = false;
-
-  constructor(data?: PartialMessage<OIDCClientConfig>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.OIDCClientConfig";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "oidc_config", kind: "message", T: OIDCConfig },
-    { no: 4, name: "oauth2_config", kind: "message", T: OAuth2Config },
-    { no: 5, name: "oauth_only", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-    { no: 6, name: "id_token_signing_alg_values_supported", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
-    { no: 7, name: "creation_time", kind: "message", T: Timestamp },
-    { no: 8, name: "status", kind: "message", T: OIDCClientConfigStatus },
-    { no: 9, name: "active", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-    { no: 10, name: "verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OIDCClientConfig {
-    return new OIDCClientConfig().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OIDCClientConfig {
-    return new OIDCClientConfig().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OIDCClientConfig {
-    return new OIDCClientConfig().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: OIDCClientConfig | PlainMessage<OIDCClientConfig> | undefined, b: OIDCClientConfig | PlainMessage<OIDCClientConfig> | undefined): boolean {
-    return proto3.util.equals(OIDCClientConfig, a, b);
-  }
+    /**
+     * ID is the unique identifier for the OIDC Config.
+     * Read only.
+     *
+     * @generated from field: string id = 1;
+     */
+    id = "";
+
+    /**
+     * @generated from field: string organization_id = 2;
+     */
+    organizationId = "";
+
+    /**
+     * @generated from field: gitpod.experimental.v1.OIDCConfig oidc_config = 3;
+     */
+    oidcConfig?: OIDCConfig;
+
+    /**
+     * @generated from field: gitpod.experimental.v1.OAuth2Config oauth2_config = 4;
+     */
+    oauth2Config?: OAuth2Config;
+
+    /**
+     * Optional.
+     *
+     * @generated from field: bool oauth_only = 5;
+     */
+    oauthOnly = false;
+
+    /**
+     * List of the JWS signing algorithms (alg values) supported by the OP for the
+     * ID Token to encode the Claims in a JWT. The algorithm RS256 MUST be
+     * included.
+     * Optional.
+     *
+     * @generated from field: repeated string id_token_signing_alg_values_supported = 6;
+     */
+    idTokenSigningAlgValuesSupported: string[] = [];
+
+    /**
+     * Time when the config was created.
+     * Read-only.
+     *
+     * @generated from field: google.protobuf.Timestamp creation_time = 7;
+     */
+    creationTime?: Timestamp;
+
+    /**
+     * Describes the status of this configuration item.
+     * Read-only.
+     *
+     * @generated from field: gitpod.experimental.v1.OIDCClientConfigStatus status = 8;
+     */
+    status?: OIDCClientConfigStatus;
+
+    /**
+     * Whether this config can be used for sign-ins.
+     * Defaults to false.
+     * Optional.
+     *
+     * @generated from field: bool active = 9;
+     */
+    active = false;
+
+    /**
+     * Whether this config was tested by executing the OIDC flow.
+     * Defaults to false.
+     * Optional.
+     *
+     * @generated from field: bool verified = 10;
+     */
+    verified = false;
+
+    constructor(data?: PartialMessage<OIDCClientConfig>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.OIDCClientConfig";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 3, name: "oidc_config", kind: "message", T: OIDCConfig },
+        { no: 4, name: "oauth2_config", kind: "message", T: OAuth2Config },
+        { no: 5, name: "oauth_only", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+        {
+            no: 6,
+            name: "id_token_signing_alg_values_supported",
+            kind: "scalar",
+            T: 9 /* ScalarType.STRING */,
+            repeated: true,
+        },
+        { no: 7, name: "creation_time", kind: "message", T: Timestamp },
+        { no: 8, name: "status", kind: "message", T: OIDCClientConfigStatus },
+        { no: 9, name: "active", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+        { no: 10, name: "verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OIDCClientConfig {
+        return new OIDCClientConfig().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OIDCClientConfig {
+        return new OIDCClientConfig().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OIDCClientConfig {
+        return new OIDCClientConfig().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: OIDCClientConfig | PlainMessage<OIDCClientConfig> | undefined,
+        b: OIDCClientConfig | PlainMessage<OIDCClientConfig> | undefined,
+    ): boolean {
+        return proto3.util.equals(OIDCClientConfig, a, b);
+    }
 }
 
 /**
@@ -139,75 +155,78 @@ export class OIDCClientConfig extends Message<OIDCClientConfig> {
  * @generated from message gitpod.experimental.v1.OIDCConfig
  */
 export class OIDCConfig extends Message<OIDCConfig> {
-  /**
-   * URL using the https scheme with no query or fragment component that the
-   * OIDC provider asserts as its Issuer Identifier.
-   * Required.
-   *
-   * @generated from field: string issuer = 1;
-   */
-  issuer = "";
-
-  /**
-   * A KeySet that can validate the id_token (JSON web token)
-   * Either one is required.
-   *
-   * @generated from field: string jwks = 2;
-   */
-  jwks = "";
-
-  /**
-   * @generated from field: string jwks_url = 3;
-   */
-  jwksUrl = "";
-
-  /**
-   * Provider specific parameters to control the behavior of the consent screen.
-   * Optional.
-   *
-   * @generated from field: gitpod.experimental.v1.ConsentScreenHints hints = 4;
-   */
-  hints?: ConsentScreenHints;
-
-  /**
-   * Optional overrides for key mapping to be applied when extracting claims from id_tokens.
-   * Should only be set, if an override is required.
-   * Optional.
-   *
-   * @generated from field: gitpod.experimental.v1.ClaimMappingOverride override_claim_mapping = 5;
-   */
-  overrideClaimMapping?: ClaimMappingOverride;
-
-  constructor(data?: PartialMessage<OIDCConfig>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.OIDCConfig";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "issuer", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "jwks", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "jwks_url", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 4, name: "hints", kind: "message", T: ConsentScreenHints },
-    { no: 5, name: "override_claim_mapping", kind: "message", T: ClaimMappingOverride },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OIDCConfig {
-    return new OIDCConfig().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OIDCConfig {
-    return new OIDCConfig().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OIDCConfig {
-    return new OIDCConfig().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: OIDCConfig | PlainMessage<OIDCConfig> | undefined, b: OIDCConfig | PlainMessage<OIDCConfig> | undefined): boolean {
-    return proto3.util.equals(OIDCConfig, a, b);
-  }
+    /**
+     * URL using the https scheme with no query or fragment component that the
+     * OIDC provider asserts as its Issuer Identifier.
+     * Required.
+     *
+     * @generated from field: string issuer = 1;
+     */
+    issuer = "";
+
+    /**
+     * A KeySet that can validate the id_token (JSON web token)
+     * Either one is required.
+     *
+     * @generated from field: string jwks = 2;
+     */
+    jwks = "";
+
+    /**
+     * @generated from field: string jwks_url = 3;
+     */
+    jwksUrl = "";
+
+    /**
+     * Provider specific parameters to control the behavior of the consent screen.
+     * Optional.
+     *
+     * @generated from field: gitpod.experimental.v1.ConsentScreenHints hints = 4;
+     */
+    hints?: ConsentScreenHints;
+
+    /**
+     * Optional overrides for key mapping to be applied when extracting claims from id_tokens.
+     * Should only be set, if an override is required.
+     * Optional.
+     *
+     * @generated from field: gitpod.experimental.v1.ClaimMappingOverride override_claim_mapping = 5;
+     */
+    overrideClaimMapping?: ClaimMappingOverride;
+
+    constructor(data?: PartialMessage<OIDCConfig>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.OIDCConfig";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "issuer", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "jwks", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 3, name: "jwks_url", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 4, name: "hints", kind: "message", T: ConsentScreenHints },
+        { no: 5, name: "override_claim_mapping", kind: "message", T: ClaimMappingOverride },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OIDCConfig {
+        return new OIDCConfig().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OIDCConfig {
+        return new OIDCConfig().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OIDCConfig {
+        return new OIDCConfig().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: OIDCConfig | PlainMessage<OIDCConfig> | undefined,
+        b: OIDCConfig | PlainMessage<OIDCConfig> | undefined,
+    ): boolean {
+        return proto3.util.equals(OIDCConfig, a, b);
+    }
 }
 
 /**
@@ -216,57 +235,60 @@ export class OIDCConfig extends Message<OIDCConfig> {
  * @generated from message gitpod.experimental.v1.ConsentScreenHints
  */
 export class ConsentScreenHints extends Message<ConsentScreenHints> {
-  /**
-   * Control options for the consent screen.
-   * Optional.
-   *
-   * @generated from field: string prompt = 1;
-   */
-  prompt = "";
-
-  /**
-   * A hint to pre-select the tenant from an AD.
-   * Optional.
-   *
-   * @generated from field: string domain_hint = 2;
-   */
-  domainHint = "";
-
-  /**
-   * Optional.
-   *
-   * @generated from field: string login_hint = 3;
-   */
-  loginHint = "";
-
-  constructor(data?: PartialMessage<ConsentScreenHints>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.ConsentScreenHints";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "prompt", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "domain_hint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "login_hint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ConsentScreenHints {
-    return new ConsentScreenHints().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ConsentScreenHints {
-    return new ConsentScreenHints().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ConsentScreenHints {
-    return new ConsentScreenHints().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ConsentScreenHints | PlainMessage<ConsentScreenHints> | undefined, b: ConsentScreenHints | PlainMessage<ConsentScreenHints> | undefined): boolean {
-    return proto3.util.equals(ConsentScreenHints, a, b);
-  }
+    /**
+     * Control options for the consent screen.
+     * Optional.
+     *
+     * @generated from field: string prompt = 1;
+     */
+    prompt = "";
+
+    /**
+     * A hint to pre-select the tenant from an AD.
+     * Optional.
+     *
+     * @generated from field: string domain_hint = 2;
+     */
+    domainHint = "";
+
+    /**
+     * Optional.
+     *
+     * @generated from field: string login_hint = 3;
+     */
+    loginHint = "";
+
+    constructor(data?: PartialMessage<ConsentScreenHints>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.ConsentScreenHints";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "prompt", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "domain_hint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 3, name: "login_hint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ConsentScreenHints {
+        return new ConsentScreenHints().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ConsentScreenHints {
+        return new ConsentScreenHints().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ConsentScreenHints {
+        return new ConsentScreenHints().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: ConsentScreenHints | PlainMessage<ConsentScreenHints> | undefined,
+        b: ConsentScreenHints | PlainMessage<ConsentScreenHints> | undefined,
+    ): boolean {
+        return proto3.util.equals(ConsentScreenHints, a, b);
+    }
 }
 
 /**
@@ -275,55 +297,58 @@ export class ConsentScreenHints extends Message<ConsentScreenHints> {
  * @generated from message gitpod.experimental.v1.ClaimMappingOverride
  */
 export class ClaimMappingOverride extends Message<ClaimMappingOverride> {
-  /**
-   * Optional.
-   *
-   * @generated from field: string claim_email_key = 1;
-   */
-  claimEmailKey = "";
-
-  /**
-   * Optional.
-   *
-   * @generated from field: string claim_groups_key = 2;
-   */
-  claimGroupsKey = "";
-
-  /**
-   * Optional.
-   *
-   * @generated from field: string claim_username_key = 3;
-   */
-  claimUsernameKey = "";
-
-  constructor(data?: PartialMessage<ClaimMappingOverride>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.ClaimMappingOverride";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "claim_email_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "claim_groups_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "claim_username_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ClaimMappingOverride {
-    return new ClaimMappingOverride().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ClaimMappingOverride {
-    return new ClaimMappingOverride().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ClaimMappingOverride {
-    return new ClaimMappingOverride().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ClaimMappingOverride | PlainMessage<ClaimMappingOverride> | undefined, b: ClaimMappingOverride | PlainMessage<ClaimMappingOverride> | undefined): boolean {
-    return proto3.util.equals(ClaimMappingOverride, a, b);
-  }
+    /**
+     * Optional.
+     *
+     * @generated from field: string claim_email_key = 1;
+     */
+    claimEmailKey = "";
+
+    /**
+     * Optional.
+     *
+     * @generated from field: string claim_groups_key = 2;
+     */
+    claimGroupsKey = "";
+
+    /**
+     * Optional.
+     *
+     * @generated from field: string claim_username_key = 3;
+     */
+    claimUsernameKey = "";
+
+    constructor(data?: PartialMessage<ClaimMappingOverride>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.ClaimMappingOverride";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "claim_email_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "claim_groups_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 3, name: "claim_username_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ClaimMappingOverride {
+        return new ClaimMappingOverride().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ClaimMappingOverride {
+        return new ClaimMappingOverride().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ClaimMappingOverride {
+        return new ClaimMappingOverride().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: ClaimMappingOverride | PlainMessage<ClaimMappingOverride> | undefined,
+        b: ClaimMappingOverride | PlainMessage<ClaimMappingOverride> | undefined,
+    ): boolean {
+        return proto3.util.equals(ClaimMappingOverride, a, b);
+    }
 }
 
 /**
@@ -332,100 +357,111 @@ export class ClaimMappingOverride extends Message<ClaimMappingOverride> {
  * @generated from message gitpod.experimental.v1.OAuth2Config
  */
 export class OAuth2Config extends Message<OAuth2Config> {
-  /**
-   * Required.
-   *
-   * @generated from field: string client_id = 1;
-   */
-  clientId = "";
-
-  /**
-   * Required for creation/updates.
-   * Empty on read.
-   *
-   * @generated from field: string client_secret = 2;
-   */
-  clientSecret = "";
-
-  /**
-   * Required.
-   *
-   * @generated from field: string authorization_endpoint = 3;
-   */
-  authorizationEndpoint = "";
-
-  /**
-   * Required.
-   *
-   * @generated from field: string token_endpoint = 4;
-   */
-  tokenEndpoint = "";
-
-  /**
-   * Required.
-   *
-   * @generated from field: repeated string scopes = 5;
-   */
-  scopes: string[] = [];
-
-  /**
-   * Source for additional claims for the token.
-   * Additional keys may be used to control the extraction of a profile.
-   * Required.
-   *
-   * @generated from field: string userinfo_endpoint = 6;
-   */
-  userinfoEndpoint = "";
-
-  /**
-   * Keys of the userinfo result to extract a profile from.
-   * Optional.
-   *
-   * @generated from field: gitpod.experimental.v1.UserInfoKeys userinfo_keys = 7;
-   */
-  userinfoKeys?: UserInfoKeys;
-
-  /**
-   * CEL expression to verify a profile.
-   * Optional.
-   *
-   * @generated from field: string cel_expression = 9;
-   */
-  celExpression = "";
-
-  constructor(data?: PartialMessage<OAuth2Config>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.OAuth2Config";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "client_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "client_secret", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "authorization_endpoint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 4, name: "token_endpoint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 5, name: "scopes", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
-    { no: 6, name: "userinfo_endpoint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 7, name: "userinfo_keys", kind: "message", T: UserInfoKeys },
-    { no: 9, name: "cel_expression", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OAuth2Config {
-    return new OAuth2Config().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OAuth2Config {
-    return new OAuth2Config().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OAuth2Config {
-    return new OAuth2Config().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: OAuth2Config | PlainMessage<OAuth2Config> | undefined, b: OAuth2Config | PlainMessage<OAuth2Config> | undefined): boolean {
-    return proto3.util.equals(OAuth2Config, a, b);
-  }
+    /**
+     * Required.
+     *
+     * @generated from field: string client_id = 1;
+     */
+    clientId = "";
+
+    /**
+     * Required for creation/updates.
+     * Empty on read.
+     *
+     * @generated from field: string client_secret = 2;
+     */
+    clientSecret = "";
+
+    /**
+     * Required.
+     *
+     * @generated from field: string authorization_endpoint = 3;
+     */
+    authorizationEndpoint = "";
+
+    /**
+     * Required.
+     *
+     * @generated from field: string token_endpoint = 4;
+     */
+    tokenEndpoint = "";
+
+    /**
+     * Required.
+     *
+     * @generated from field: repeated string scopes = 5;
+     */
+    scopes: string[] = [];
+
+    /**
+     * Source for additional claims for the token.
+     * Additional keys may be used to control the extraction of a profile.
+     * Required.
+     *
+     * @generated from field: string userinfo_endpoint = 6;
+     */
+    userinfoEndpoint = "";
+
+    /**
+     * Keys of the userinfo result to extract a profile from.
+     * Optional.
+     *
+     * @generated from field: gitpod.experimental.v1.UserInfoKeys userinfo_keys = 7;
+     */
+    userinfoKeys?: UserInfoKeys;
+
+    /**
+     * CEL expression to verify a profile.
+     * Optional.
+     *
+     * @generated from field: string cel_expression = 9;
+     */
+    celExpression = "";
+
+    /**
+     * Use PKCE for the OAuth2 flow.
+     *
+     * @generated from field: bool use_pkce = 10;
+     */
+    usePkce = false;
+
+    constructor(data?: PartialMessage<OAuth2Config>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.OAuth2Config";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "client_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "client_secret", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 3, name: "authorization_endpoint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 4, name: "token_endpoint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 5, name: "scopes", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
+        { no: 6, name: "userinfo_endpoint", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 7, name: "userinfo_keys", kind: "message", T: UserInfoKeys },
+        { no: 9, name: "cel_expression", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 10, name: "use_pkce", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OAuth2Config {
+        return new OAuth2Config().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OAuth2Config {
+        return new OAuth2Config().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OAuth2Config {
+        return new OAuth2Config().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: OAuth2Config | PlainMessage<OAuth2Config> | undefined,
+        b: OAuth2Config | PlainMessage<OAuth2Config> | undefined,
+    ): boolean {
+        return proto3.util.equals(OAuth2Config, a, b);
+    }
 }
 
 /**
@@ -434,47 +470,50 @@ export class OAuth2Config extends Message<OAuth2Config> {
  * @generated from message gitpod.experimental.v1.UserInfoKeys
  */
 export class UserInfoKeys extends Message<UserInfoKeys> {
-  /**
-   * Optional.
-   *
-   * @generated from field: string userinfo_id_key = 1;
-   */
-  userinfoIdKey = "";
-
-  /**
-   * Optional.
-   *
-   * @generated from field: string userinfo_name_key = 2;
-   */
-  userinfoNameKey = "";
-
-  constructor(data?: PartialMessage<UserInfoKeys>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.UserInfoKeys";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "userinfo_id_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "userinfo_name_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UserInfoKeys {
-    return new UserInfoKeys().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UserInfoKeys {
-    return new UserInfoKeys().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UserInfoKeys {
-    return new UserInfoKeys().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: UserInfoKeys | PlainMessage<UserInfoKeys> | undefined, b: UserInfoKeys | PlainMessage<UserInfoKeys> | undefined): boolean {
-    return proto3.util.equals(UserInfoKeys, a, b);
-  }
+    /**
+     * Optional.
+     *
+     * @generated from field: string userinfo_id_key = 1;
+     */
+    userinfoIdKey = "";
+
+    /**
+     * Optional.
+     *
+     * @generated from field: string userinfo_name_key = 2;
+     */
+    userinfoNameKey = "";
+
+    constructor(data?: PartialMessage<UserInfoKeys>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.UserInfoKeys";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "userinfo_id_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "userinfo_name_key", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UserInfoKeys {
+        return new UserInfoKeys().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UserInfoKeys {
+        return new UserInfoKeys().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UserInfoKeys {
+        return new UserInfoKeys().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: UserInfoKeys | PlainMessage<UserInfoKeys> | undefined,
+        b: UserInfoKeys | PlainMessage<UserInfoKeys> | undefined,
+    ): boolean {
+        return proto3.util.equals(UserInfoKeys, a, b);
+    }
 }
 
 /**
@@ -483,501 +522,536 @@ export class UserInfoKeys extends Message<UserInfoKeys> {
  * @generated from message gitpod.experimental.v1.OIDCClientConfigStatus
  */
 export class OIDCClientConfigStatus extends Message<OIDCClientConfigStatus> {
-  constructor(data?: PartialMessage<OIDCClientConfigStatus>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.OIDCClientConfigStatus";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OIDCClientConfigStatus {
-    return new OIDCClientConfigStatus().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OIDCClientConfigStatus {
-    return new OIDCClientConfigStatus().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OIDCClientConfigStatus {
-    return new OIDCClientConfigStatus().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: OIDCClientConfigStatus | PlainMessage<OIDCClientConfigStatus> | undefined, b: OIDCClientConfigStatus | PlainMessage<OIDCClientConfigStatus> | undefined): boolean {
-    return proto3.util.equals(OIDCClientConfigStatus, a, b);
-  }
+    constructor(data?: PartialMessage<OIDCClientConfigStatus>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.OIDCClientConfigStatus";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => []);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OIDCClientConfigStatus {
+        return new OIDCClientConfigStatus().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OIDCClientConfigStatus {
+        return new OIDCClientConfigStatus().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OIDCClientConfigStatus {
+        return new OIDCClientConfigStatus().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: OIDCClientConfigStatus | PlainMessage<OIDCClientConfigStatus> | undefined,
+        b: OIDCClientConfigStatus | PlainMessage<OIDCClientConfigStatus> | undefined,
+    ): boolean {
+        return proto3.util.equals(OIDCClientConfigStatus, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.CreateClientConfigRequest
  */
 export class CreateClientConfigRequest extends Message<CreateClientConfigRequest> {
-  /**
-   * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
-   */
-  config?: OIDCClientConfig;
-
-  /**
-   * Optional.
-   *
-   * @generated from field: bool use_discovery = 2;
-   */
-  useDiscovery = false;
-
-  constructor(data?: PartialMessage<CreateClientConfigRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.CreateClientConfigRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
-    { no: 2, name: "use_discovery", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateClientConfigRequest {
-    return new CreateClientConfigRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateClientConfigRequest {
-    return new CreateClientConfigRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateClientConfigRequest {
-    return new CreateClientConfigRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: CreateClientConfigRequest | PlainMessage<CreateClientConfigRequest> | undefined, b: CreateClientConfigRequest | PlainMessage<CreateClientConfigRequest> | undefined): boolean {
-    return proto3.util.equals(CreateClientConfigRequest, a, b);
-  }
+    /**
+     * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
+     */
+    config?: OIDCClientConfig;
+
+    /**
+     * Optional.
+     *
+     * @generated from field: bool use_discovery = 2;
+     */
+    useDiscovery = false;
+
+    constructor(data?: PartialMessage<CreateClientConfigRequest>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.CreateClientConfigRequest";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
+        { no: 2, name: "use_discovery", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateClientConfigRequest {
+        return new CreateClientConfigRequest().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateClientConfigRequest {
+        return new CreateClientConfigRequest().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateClientConfigRequest {
+        return new CreateClientConfigRequest().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: CreateClientConfigRequest | PlainMessage<CreateClientConfigRequest> | undefined,
+        b: CreateClientConfigRequest | PlainMessage<CreateClientConfigRequest> | undefined,
+    ): boolean {
+        return proto3.util.equals(CreateClientConfigRequest, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.CreateClientConfigResponse
  */
 export class CreateClientConfigResponse extends Message<CreateClientConfigResponse> {
-  /**
-   * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
-   */
-  config?: OIDCClientConfig;
-
-  constructor(data?: PartialMessage<CreateClientConfigResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.CreateClientConfigResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateClientConfigResponse {
-    return new CreateClientConfigResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateClientConfigResponse {
-    return new CreateClientConfigResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateClientConfigResponse {
-    return new CreateClientConfigResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: CreateClientConfigResponse | PlainMessage<CreateClientConfigResponse> | undefined, b: CreateClientConfigResponse | PlainMessage<CreateClientConfigResponse> | undefined): boolean {
-    return proto3.util.equals(CreateClientConfigResponse, a, b);
-  }
+    /**
+     * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
+     */
+    config?: OIDCClientConfig;
+
+    constructor(data?: PartialMessage<CreateClientConfigResponse>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.CreateClientConfigResponse";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateClientConfigResponse {
+        return new CreateClientConfigResponse().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateClientConfigResponse {
+        return new CreateClientConfigResponse().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateClientConfigResponse {
+        return new CreateClientConfigResponse().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: CreateClientConfigResponse | PlainMessage<CreateClientConfigResponse> | undefined,
+        b: CreateClientConfigResponse | PlainMessage<CreateClientConfigResponse> | undefined,
+    ): boolean {
+        return proto3.util.equals(CreateClientConfigResponse, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.GetClientConfigRequest
  */
 export class GetClientConfigRequest extends Message<GetClientConfigRequest> {
-  /**
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string organization_id = 2;
-   */
-  organizationId = "";
-
-  constructor(data?: PartialMessage<GetClientConfigRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.GetClientConfigRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetClientConfigRequest {
-    return new GetClientConfigRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetClientConfigRequest {
-    return new GetClientConfigRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetClientConfigRequest {
-    return new GetClientConfigRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetClientConfigRequest | PlainMessage<GetClientConfigRequest> | undefined, b: GetClientConfigRequest | PlainMessage<GetClientConfigRequest> | undefined): boolean {
-    return proto3.util.equals(GetClientConfigRequest, a, b);
-  }
+    /**
+     * @generated from field: string id = 1;
+     */
+    id = "";
+
+    /**
+     * @generated from field: string organization_id = 2;
+     */
+    organizationId = "";
+
+    constructor(data?: PartialMessage<GetClientConfigRequest>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.GetClientConfigRequest";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetClientConfigRequest {
+        return new GetClientConfigRequest().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetClientConfigRequest {
+        return new GetClientConfigRequest().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetClientConfigRequest {
+        return new GetClientConfigRequest().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: GetClientConfigRequest | PlainMessage<GetClientConfigRequest> | undefined,
+        b: GetClientConfigRequest | PlainMessage<GetClientConfigRequest> | undefined,
+    ): boolean {
+        return proto3.util.equals(GetClientConfigRequest, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.GetClientConfigResponse
  */
 export class GetClientConfigResponse extends Message<GetClientConfigResponse> {
-  /**
-   * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
-   */
-  config?: OIDCClientConfig;
-
-  constructor(data?: PartialMessage<GetClientConfigResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.GetClientConfigResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetClientConfigResponse {
-    return new GetClientConfigResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetClientConfigResponse {
-    return new GetClientConfigResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetClientConfigResponse {
-    return new GetClientConfigResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetClientConfigResponse | PlainMessage<GetClientConfigResponse> | undefined, b: GetClientConfigResponse | PlainMessage<GetClientConfigResponse> | undefined): boolean {
-    return proto3.util.equals(GetClientConfigResponse, a, b);
-  }
+    /**
+     * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
+     */
+    config?: OIDCClientConfig;
+
+    constructor(data?: PartialMessage<GetClientConfigResponse>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.GetClientConfigResponse";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetClientConfigResponse {
+        return new GetClientConfigResponse().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetClientConfigResponse {
+        return new GetClientConfigResponse().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetClientConfigResponse {
+        return new GetClientConfigResponse().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: GetClientConfigResponse | PlainMessage<GetClientConfigResponse> | undefined,
+        b: GetClientConfigResponse | PlainMessage<GetClientConfigResponse> | undefined,
+    ): boolean {
+        return proto3.util.equals(GetClientConfigResponse, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.ListClientConfigsRequest
  */
 export class ListClientConfigsRequest extends Message<ListClientConfigsRequest> {
-  /**
-   * @generated from field: string organization_id = 1;
-   */
-  organizationId = "";
-
-  /**
-   * Page information
-   *
-   * @generated from field: gitpod.experimental.v1.Pagination pagination = 2;
-   */
-  pagination?: Pagination;
-
-  constructor(data?: PartialMessage<ListClientConfigsRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.ListClientConfigsRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "pagination", kind: "message", T: Pagination },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListClientConfigsRequest {
-    return new ListClientConfigsRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListClientConfigsRequest {
-    return new ListClientConfigsRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListClientConfigsRequest {
-    return new ListClientConfigsRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ListClientConfigsRequest | PlainMessage<ListClientConfigsRequest> | undefined, b: ListClientConfigsRequest | PlainMessage<ListClientConfigsRequest> | undefined): boolean {
-    return proto3.util.equals(ListClientConfigsRequest, a, b);
-  }
+    /**
+     * @generated from field: string organization_id = 1;
+     */
+    organizationId = "";
+
+    /**
+     * Page information
+     *
+     * @generated from field: gitpod.experimental.v1.Pagination pagination = 2;
+     */
+    pagination?: Pagination;
+
+    constructor(data?: PartialMessage<ListClientConfigsRequest>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.ListClientConfigsRequest";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "pagination", kind: "message", T: Pagination },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListClientConfigsRequest {
+        return new ListClientConfigsRequest().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListClientConfigsRequest {
+        return new ListClientConfigsRequest().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListClientConfigsRequest {
+        return new ListClientConfigsRequest().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: ListClientConfigsRequest | PlainMessage<ListClientConfigsRequest> | undefined,
+        b: ListClientConfigsRequest | PlainMessage<ListClientConfigsRequest> | undefined,
+    ): boolean {
+        return proto3.util.equals(ListClientConfigsRequest, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.ListClientConfigsResponse
  */
 export class ListClientConfigsResponse extends Message<ListClientConfigsResponse> {
-  /**
-   * @generated from field: repeated gitpod.experimental.v1.OIDCClientConfig client_configs = 1;
-   */
-  clientConfigs: OIDCClientConfig[] = [];
-
-  /**
-   * @generated from field: int64 total_results = 2;
-   */
-  totalResults = protoInt64.zero;
-
-  constructor(data?: PartialMessage<ListClientConfigsResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.ListClientConfigsResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "client_configs", kind: "message", T: OIDCClientConfig, repeated: true },
-    { no: 2, name: "total_results", kind: "scalar", T: 3 /* ScalarType.INT64 */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListClientConfigsResponse {
-    return new ListClientConfigsResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListClientConfigsResponse {
-    return new ListClientConfigsResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListClientConfigsResponse {
-    return new ListClientConfigsResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ListClientConfigsResponse | PlainMessage<ListClientConfigsResponse> | undefined, b: ListClientConfigsResponse | PlainMessage<ListClientConfigsResponse> | undefined): boolean {
-    return proto3.util.equals(ListClientConfigsResponse, a, b);
-  }
+    /**
+     * @generated from field: repeated gitpod.experimental.v1.OIDCClientConfig client_configs = 1;
+     */
+    clientConfigs: OIDCClientConfig[] = [];
+
+    /**
+     * @generated from field: int64 total_results = 2;
+     */
+    totalResults = protoInt64.zero;
+
+    constructor(data?: PartialMessage<ListClientConfigsResponse>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.ListClientConfigsResponse";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "client_configs", kind: "message", T: OIDCClientConfig, repeated: true },
+        { no: 2, name: "total_results", kind: "scalar", T: 3 /* ScalarType.INT64 */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListClientConfigsResponse {
+        return new ListClientConfigsResponse().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListClientConfigsResponse {
+        return new ListClientConfigsResponse().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListClientConfigsResponse {
+        return new ListClientConfigsResponse().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: ListClientConfigsResponse | PlainMessage<ListClientConfigsResponse> | undefined,
+        b: ListClientConfigsResponse | PlainMessage<ListClientConfigsResponse> | undefined,
+    ): boolean {
+        return proto3.util.equals(ListClientConfigsResponse, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.UpdateClientConfigRequest
  */
 export class UpdateClientConfigRequest extends Message<UpdateClientConfigRequest> {
-  /**
-   * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
-   */
-  config?: OIDCClientConfig;
-
-  constructor(data?: PartialMessage<UpdateClientConfigRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.UpdateClientConfigRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdateClientConfigRequest {
-    return new UpdateClientConfigRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdateClientConfigRequest {
-    return new UpdateClientConfigRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdateClientConfigRequest {
-    return new UpdateClientConfigRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: UpdateClientConfigRequest | PlainMessage<UpdateClientConfigRequest> | undefined, b: UpdateClientConfigRequest | PlainMessage<UpdateClientConfigRequest> | undefined): boolean {
-    return proto3.util.equals(UpdateClientConfigRequest, a, b);
-  }
+    /**
+     * @generated from field: gitpod.experimental.v1.OIDCClientConfig config = 1;
+     */
+    config?: OIDCClientConfig;
+
+    constructor(data?: PartialMessage<UpdateClientConfigRequest>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.UpdateClientConfigRequest";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "config", kind: "message", T: OIDCClientConfig },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdateClientConfigRequest {
+        return new UpdateClientConfigRequest().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdateClientConfigRequest {
+        return new UpdateClientConfigRequest().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdateClientConfigRequest {
+        return new UpdateClientConfigRequest().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: UpdateClientConfigRequest | PlainMessage<UpdateClientConfigRequest> | undefined,
+        b: UpdateClientConfigRequest | PlainMessage<UpdateClientConfigRequest> | undefined,
+    ): boolean {
+        return proto3.util.equals(UpdateClientConfigRequest, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.UpdateClientConfigResponse
  */
 export class UpdateClientConfigResponse extends Message<UpdateClientConfigResponse> {
-  constructor(data?: PartialMessage<UpdateClientConfigResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.UpdateClientConfigResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdateClientConfigResponse {
-    return new UpdateClientConfigResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdateClientConfigResponse {
-    return new UpdateClientConfigResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdateClientConfigResponse {
-    return new UpdateClientConfigResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: UpdateClientConfigResponse | PlainMessage<UpdateClientConfigResponse> | undefined, b: UpdateClientConfigResponse | PlainMessage<UpdateClientConfigResponse> | undefined): boolean {
-    return proto3.util.equals(UpdateClientConfigResponse, a, b);
-  }
+    constructor(data?: PartialMessage<UpdateClientConfigResponse>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.UpdateClientConfigResponse";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => []);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdateClientConfigResponse {
+        return new UpdateClientConfigResponse().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdateClientConfigResponse {
+        return new UpdateClientConfigResponse().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdateClientConfigResponse {
+        return new UpdateClientConfigResponse().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: UpdateClientConfigResponse | PlainMessage<UpdateClientConfigResponse> | undefined,
+        b: UpdateClientConfigResponse | PlainMessage<UpdateClientConfigResponse> | undefined,
+    ): boolean {
+        return proto3.util.equals(UpdateClientConfigResponse, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.DeleteClientConfigRequest
  */
 export class DeleteClientConfigRequest extends Message<DeleteClientConfigRequest> {
-  /**
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string organization_id = 2;
-   */
-  organizationId = "";
-
-  constructor(data?: PartialMessage<DeleteClientConfigRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.DeleteClientConfigRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): DeleteClientConfigRequest {
-    return new DeleteClientConfigRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): DeleteClientConfigRequest {
-    return new DeleteClientConfigRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): DeleteClientConfigRequest {
-    return new DeleteClientConfigRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: DeleteClientConfigRequest | PlainMessage<DeleteClientConfigRequest> | undefined, b: DeleteClientConfigRequest | PlainMessage<DeleteClientConfigRequest> | undefined): boolean {
-    return proto3.util.equals(DeleteClientConfigRequest, a, b);
-  }
+    /**
+     * @generated from field: string id = 1;
+     */
+    id = "";
+
+    /**
+     * @generated from field: string organization_id = 2;
+     */
+    organizationId = "";
+
+    constructor(data?: PartialMessage<DeleteClientConfigRequest>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.DeleteClientConfigRequest";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): DeleteClientConfigRequest {
+        return new DeleteClientConfigRequest().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): DeleteClientConfigRequest {
+        return new DeleteClientConfigRequest().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): DeleteClientConfigRequest {
+        return new DeleteClientConfigRequest().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: DeleteClientConfigRequest | PlainMessage<DeleteClientConfigRequest> | undefined,
+        b: DeleteClientConfigRequest | PlainMessage<DeleteClientConfigRequest> | undefined,
+    ): boolean {
+        return proto3.util.equals(DeleteClientConfigRequest, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.DeleteClientConfigResponse
  */
 export class DeleteClientConfigResponse extends Message<DeleteClientConfigResponse> {
-  constructor(data?: PartialMessage<DeleteClientConfigResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.DeleteClientConfigResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): DeleteClientConfigResponse {
-    return new DeleteClientConfigResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): DeleteClientConfigResponse {
-    return new DeleteClientConfigResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): DeleteClientConfigResponse {
-    return new DeleteClientConfigResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: DeleteClientConfigResponse | PlainMessage<DeleteClientConfigResponse> | undefined, b: DeleteClientConfigResponse | PlainMessage<DeleteClientConfigResponse> | undefined): boolean {
-    return proto3.util.equals(DeleteClientConfigResponse, a, b);
-  }
+    constructor(data?: PartialMessage<DeleteClientConfigResponse>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.DeleteClientConfigResponse";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => []);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): DeleteClientConfigResponse {
+        return new DeleteClientConfigResponse().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): DeleteClientConfigResponse {
+        return new DeleteClientConfigResponse().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): DeleteClientConfigResponse {
+        return new DeleteClientConfigResponse().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: DeleteClientConfigResponse | PlainMessage<DeleteClientConfigResponse> | undefined,
+        b: DeleteClientConfigResponse | PlainMessage<DeleteClientConfigResponse> | undefined,
+    ): boolean {
+        return proto3.util.equals(DeleteClientConfigResponse, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.SetClientConfigActivationRequest
  */
 export class SetClientConfigActivationRequest extends Message<SetClientConfigActivationRequest> {
-  /**
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string organization_id = 2;
-   */
-  organizationId = "";
-
-  /**
-   * @generated from field: bool activate = 3;
-   */
-  activate = false;
-
-  constructor(data?: PartialMessage<SetClientConfigActivationRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.SetClientConfigActivationRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "activate", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): SetClientConfigActivationRequest {
-    return new SetClientConfigActivationRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): SetClientConfigActivationRequest {
-    return new SetClientConfigActivationRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): SetClientConfigActivationRequest {
-    return new SetClientConfigActivationRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: SetClientConfigActivationRequest | PlainMessage<SetClientConfigActivationRequest> | undefined, b: SetClientConfigActivationRequest | PlainMessage<SetClientConfigActivationRequest> | undefined): boolean {
-    return proto3.util.equals(SetClientConfigActivationRequest, a, b);
-  }
+    /**
+     * @generated from field: string id = 1;
+     */
+    id = "";
+
+    /**
+     * @generated from field: string organization_id = 2;
+     */
+    organizationId = "";
+
+    /**
+     * @generated from field: bool activate = 3;
+     */
+    activate = false;
+
+    constructor(data?: PartialMessage<SetClientConfigActivationRequest>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.SetClientConfigActivationRequest";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => [
+        { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 2, name: "organization_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+        { no: 3, name: "activate", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
+    ]);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): SetClientConfigActivationRequest {
+        return new SetClientConfigActivationRequest().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): SetClientConfigActivationRequest {
+        return new SetClientConfigActivationRequest().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): SetClientConfigActivationRequest {
+        return new SetClientConfigActivationRequest().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: SetClientConfigActivationRequest | PlainMessage<SetClientConfigActivationRequest> | undefined,
+        b: SetClientConfigActivationRequest | PlainMessage<SetClientConfigActivationRequest> | undefined,
+    ): boolean {
+        return proto3.util.equals(SetClientConfigActivationRequest, a, b);
+    }
 }
 
 /**
  * @generated from message gitpod.experimental.v1.SetClientConfigActivationResponse
  */
 export class SetClientConfigActivationResponse extends Message<SetClientConfigActivationResponse> {
-  constructor(data?: PartialMessage<SetClientConfigActivationResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "gitpod.experimental.v1.SetClientConfigActivationResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): SetClientConfigActivationResponse {
-    return new SetClientConfigActivationResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): SetClientConfigActivationResponse {
-    return new SetClientConfigActivationResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): SetClientConfigActivationResponse {
-    return new SetClientConfigActivationResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: SetClientConfigActivationResponse | PlainMessage<SetClientConfigActivationResponse> | undefined, b: SetClientConfigActivationResponse | PlainMessage<SetClientConfigActivationResponse> | undefined): boolean {
-    return proto3.util.equals(SetClientConfigActivationResponse, a, b);
-  }
+    constructor(data?: PartialMessage<SetClientConfigActivationResponse>) {
+        super();
+        proto3.util.initPartial(data, this);
+    }
+
+    static readonly runtime: typeof proto3 = proto3;
+    static readonly typeName = "gitpod.experimental.v1.SetClientConfigActivationResponse";
+    static readonly fields: FieldList = proto3.util.newFieldList(() => []);
+
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): SetClientConfigActivationResponse {
+        return new SetClientConfigActivationResponse().fromBinary(bytes, options);
+    }
+
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): SetClientConfigActivationResponse {
+        return new SetClientConfigActivationResponse().fromJson(jsonValue, options);
+    }
+
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): SetClientConfigActivationResponse {
+        return new SetClientConfigActivationResponse().fromJsonString(jsonString, options);
+    }
+
+    static equals(
+        a: SetClientConfigActivationResponse | PlainMessage<SetClientConfigActivationResponse> | undefined,
+        b: SetClientConfigActivationResponse | PlainMessage<SetClientConfigActivationResponse> | undefined,
+    ): boolean {
+        return proto3.util.equals(SetClientConfigActivationResponse, a, b);
+    }
 }