PKCE is an OAuth extension that protects the authorization code flow against interception. The client generates a secret verifier, sends its hash with the authorization request, and presents the verifier when redeeming the code — so an attacker who steals the code cannot exchange it.
PKCE (Proof Key for Code Exchange)
PKCE (Proof Key for Code Exchange) (RFC 7636) — PKCE is an OAuth extension that protects the authorization code flow against interception. The client generates a secret verifier, sends its hash with the authorization request, and presents the verifier when redeeming the code — so an attacker who steals the code cannot exchange it.
- Built for public clients - Originally for mobile and single-page apps that cannot keep a client secret.
- Now recommended for everyone - The Security BCP and OAuth 2.1 require it for all authorization code flows, confidential clients included.
- It is what made implicit unnecessary - The implicit grant existed because browsers could not keep a secret. PKCE solved that.
PKCE is the reason the implicit grant has no remaining justification, which makes it the practical answer to the 775 contracts still declaring implicit in The OAuth 2.0 Standard. The migration is authorization code plus PKCE, and it is well-supported in every major OAuth library.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The OAuth 2.0 Standard
The reason implicit has no remaining justification, and the migration path for the 775 contracts still declaring it.
