Authorization Code + PKCE

PKCE (Proof Key for Code Exchange) extends the authorization code flow for public clients that cannot securely store a client secret.

Overview

PKCE protects against authorization code interception attacks by using a dynamically generated secret.

When to Use

  • Mobile applications

  • Single-page applications (SPAs)

  • Desktop applications

  • Any client that cannot securely store secrets

Flow Diagram

spinner

PKCE Parameters

Parameter
Description

code_verifier

Random string 43-128 characters

code_challenge

Base64URL(SHA256(code_verifier))

code_challenge_method

S256 (recommended) or plain

Generate PKCE Values

JavaScript

Python

Authorization Request

GET /authorize

Parameters

Parameter
Required
Description

response_type

Yes

Must be code

client_id

Yes

Your client identifier

redirect_uri

Yes

Callback URL

scope

Yes

Space-separated scopes

state

Recommended

CSRF protection

code_challenge

Yes

Base64URL(SHA256(verifier))

code_challenge_method

Yes

S256

Example

Token Request

POST /token

Parameters

Parameter
Required
Description

grant_type

Yes

authorization_code

code

Yes

Authorization code

redirect_uri

Yes

Same as authorization

client_id

Yes

Client identifier

code_verifier

Yes

Original code verifier

Example

circle-info

Note: No client_secret is required for public clients with PKCE.

Complete Example

React SPA

Mobile (React Native)

Security Benefits

PKCE prevents:

  1. Authorization code interception - Attacker cannot use stolen code without verifier

  2. Redirect hijacking - Code is useless without the original verifier

  3. Man-in-the-middle attacks - Verifier is never transmitted before token exchange

Best Practices

circle-check

Next Steps

Last updated

Was this helpful?