What is PKCE?

PKCE (Proof Key for Code Exchange) is a security extension to the OAuth 2.0 authorization protocol. It is designed to prevent certain attacks, such as authorization code interception, especially when OAuth 2.0 is used with native or mobile applications. PKCE works by having the client application generate a secret (code verifier), derive a transformed value from it (code challenge), and send the code challenge along with the authorization request. The authorization server then returns an authorization code. The client then uses the authorization code and the original code verifier to request an access token. The server verifies that the code verifier matches the code challenge. This process prevents an attacker who intercepts the authorization code from exchanging it for an access token, as they would also need the code verifier.