PKCE
acronymsecuritycryptography
Stands for: Proof Key for Code Exchange
An OAuth extension that protects the authorization-code flow.
Proof Key for Code Exchange (RFC 7636) binds an authorization code to the client that requested it, using a one-time secret. It stops an intercepted code from being redeemed by an attacker and is now standard for public OAuth clients.
PKCE closes a hole that mobile and single-page applications opened. The authorization code flow was designed assuming the client could keep a secret, which a server can and a phone app or browser bundle cannot, since anyone can decompile or view source. Without a secret, an attacker who intercepts the authorization code can redeem it themselves.
The fix is elegantly simple. The client generates a random verifier, sends only its hash when starting the flow, and presents the original verifier when exchanging the code. The authorization server checks that they correspond. An intercepted code is now useless without the verifier, which never left the client.
What began as a mobile workaround became the general recommendation. Current guidance applies PKCE to confidential clients too, because it costs almost nothing and defends against code interception regardless of whether a client secret exists. If you are choosing a flow for anything interactive today, authorization code with PKCE is the answer, and the implicit flow it replaced is deprecated for exactly the reasons PKCE addresses.
Also known as: pkce