PKCE

What it means

PKCE, short for Proof Key for Code Exchange and said "pixy", is an extension to the OAuth authorisation code flow, defined in RFC 7636. Before the sign-in, the app makes a random secret called the code verifier and sends only its hash, the code challenge, with the request.

When the app later swaps the authorisation code for tokens, it must send the original verifier. The server hashes it and compares. A thief who intercepted the code does not have the verifier, so the swap fails. Without the verifier, the code is useless to them.

Why it matters

Authorisation codes travel through the browser or a mobile app's redirect, where other software can sometimes read them. Without PKCE, whoever grabs a code can try to exchange it. Mobile apps and single-page apps cannot keep a client secret, so they have nothing else to stop that.

The current OAuth security guidance, RFC 9700, requires public clients to use PKCE and recommends it for all clients. It also helps against code injection, where an attacker plants their own code in a victim's session. Skipping it is a finding in many reviews.

How it shows up

You meet PKCE in sign-in with a social or company account, in mobile apps, and in single-page apps. Most good libraries switch it on for you. Check that your authorisation server actually requires it, because supporting it and enforcing it are different.

Common mistakes: using the plain method when S256 is available, a weak or reused verifier, a verifier kept in a place other code can read, and a server that accepts a code request without a challenge. An attacker may simply leave the challenge out, so the server must reject a missing verifier.