diff --git a/addons/api/addon/serializers/application.js b/addons/api/addon/serializers/application.js
index bb21c2ea6..51d2c6baa 100644
--- a/addons/api/addon/serializers/application.js
+++ b/addons/api/addon/serializers/application.js
@@ -42,6 +42,7 @@ export default class ApplicationSerializer extends RESTSerializer {
    */
   serializeAttribute(snapshot, json, key, attribute) {
     const { type, options } = attribute;
+    const { type: recordType } = snapshot.record;
     let value = super.serializeAttribute(...arguments);
     // Remove secret attributes that are null or empty
     if (options.isSecret) {
@@ -72,6 +73,21 @@ export default class ApplicationSerializer extends RESTSerializer {
       }
       delete json[key];
     }
+    // If an attribute has a `for` option, it must match the
+    // record's `type`, else the attribute is excluded
+    // from serialization.
+    //note: This doesn't handle secrets yet, we can add support for them if needed.
+    if (
+      options?.for &&
+      options.for !== recordType &&
+      !options.for.includes(recordType)
+    ) {
+      if (options.isNestedAttribute) {
+        delete json?.attributes?.[key];
+      } else {
+        delete json[key];
+      }
+    }
     return value;
   }
 
diff --git a/addons/api/addon/serializers/auth-method.js b/addons/api/addon/serializers/auth-method.js
index 8ceb461ab..83c90062d 100644
--- a/addons/api/addon/serializers/auth-method.js
+++ b/addons/api/addon/serializers/auth-method.js
@@ -24,21 +24,6 @@ export default class AuthMethodSerializer extends ApplicationSerializer {
     }
   }
 
-  serializeAttribute(snapshot, json, key, attribute) {
-    const { type } = snapshot.record;
-    super.serializeAttribute(...arguments);
-    const { options } = attribute;
-
-    // If an attribute has a `for` option, it must match the
-    // record's `type`, else the attribute is excluded
-    // from serialization.
-    if (options?.for && !options.for.includes(type)) {
-      if (options.isNestedAttribute) {
-        delete json?.attributes?.[key];
-      }
-    }
-  }
-
   /**
    * Password serialization omits `attributes`.
    * @return {object}
diff --git a/addons/api/addon/serializers/credential-library.js b/addons/api/addon/serializers/credential-library.js
index 530ee9a1f..296da252e 100644
--- a/addons/api/addon/serializers/credential-library.js
+++ b/addons/api/addon/serializers/credential-library.js
@@ -32,23 +32,6 @@ export default class CredentialLibrarySerializer extends ApplicationSerializer {
     }
   }
 
-  serializeAttribute(snapshot, json, key, attribute) {
-    super.serializeAttribute(...arguments);
-    const { options } = attribute;
-    const { type } = snapshot.record;
-
-    // If an attribute has a `for` option, it must match the
-    // record's `type`, else the attribute is excluded
-    // from serialization.
-    if (options?.for && options.for !== type) {
-      if (options.isNestedAttribute) {
-        delete json.attributes[key];
-      } else {
-        delete json[key];
-      }
-    }
-  }
-
   serializeVaultGeneric() {
     const serialized = super.serialize(...arguments);
     if (serialized.attributes) {
diff --git a/addons/api/tests/unit/serializers/application-test.js b/addons/api/tests/unit/serializers/application-test.js
index 1975c46c9..3e94a252a 100644
--- a/addons/api/tests/unit/serializers/application-test.js
+++ b/addons/api/tests/unit/serializers/application-test.js
@@ -5,6 +5,7 @@
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
+import { TYPE_AUTH_METHOD_OIDC } from 'api/models/auth-method';
 
 module('Unit | Serializer | application', function (hooks) {
   setupTest(hooks);
@@ -139,6 +140,56 @@ module('Unit | Serializer | application', function (hooks) {
     });
   });
 
+  test('it serializes attributes with `for` option containing array or string correctly', function (assert) {
+    assert.expect(1);
+    let store = this.owner.lookup('service:store');
+    let record = store.createRecord('auth-method', {
+      type: TYPE_AUTH_METHOD_OIDC, //has both string and array `for` option
+      name: 'OIDC Auth Method',
+      state: 'foo',
+      account_claim_maps: [{ from: 'foo', to: 'bar' }],
+      claims_scopes: [{ value: 'profile' }, { value: 'email' }],
+      signing_algorithms: [{ value: 'RS256' }, { value: 'RS384' }],
+      allowed_audiences: [
+        { value: 'www.alice.com' },
+        { value: 'www.alice.com/admin' },
+      ],
+      idp_ca_certs: [
+        { value: 'certificate-1234' },
+        { value: 'certificate-5678' },
+      ],
+      api_url_prefix: 'protocol://host:port/foo',
+      client_id: 'id123',
+      client_secret: 'secret456',
+      disable_discovered_config_validation: true,
+      dry_run: true,
+      issuer: 'http://www.example.net',
+      max_age: 500,
+    });
+
+    let serializedRecord = record.serialize();
+
+    assert.deepEqual(serializedRecord, {
+      type: TYPE_AUTH_METHOD_OIDC,
+      name: 'OIDC Auth Method',
+      description: null,
+      attributes: {
+        account_claim_maps: ['foo=bar'],
+        claims_scopes: ['profile', 'email'],
+        signing_algorithms: ['RS256', 'RS384'],
+        allowed_audiences: ['www.alice.com', 'www.alice.com/admin'],
+        idp_ca_certs: ['certificate-1234', 'certificate-5678'],
+        api_url_prefix: 'protocol://host:port/foo',
+        client_id: 'id123',
+        client_secret: 'secret456',
+        disable_discovered_config_validation: true,
+        dry_run: true,
+        issuer: 'http://www.example.net',
+        max_age: 500,
+      },
+    });
+  });
+
   test('it normalizes array records from an `items` root key', function (assert) {
     assert.expect(1);
     const store = this.owner.lookup('service:store');