PKCE Explained: Securing the OAuth 2.0 Authorization Code Flow

Proof Key for Code Exchange (PKCE) PKCE stands for Proof Key for Code Exchange . It is a security extension for the OAuth 2.0 Authorization Code Flow that protects the authorization code from interception attacks. As the name suggests, PKCE is used to secure the authorization code exchange during the OAuth authentication flow. PKCE is primarily designed for public clients such as mobile applications and single-page applications (SPAs), which cannot securely store a client secret. Why is it needed? In the traditional OAuth 2.0 Authorization Code Flow: The application requests an authorization code. The authorization server returns the authorization code. The application exchanges the authorization code for tokens using its client credentials ( client_id and optionally client_secret ). The Problem In the above flow, the problem is that public clients do not have a client secret. An attacker may intercept the authorization code from the redirect URI (for example through a malicious applic