← Back to glossary
🧷

PKCE

Authentication

Authorization Mobile Privacy Access Token OAuth 2.0

OAuth 2.0 extension (Proof Key for Code Exchange) mitigating authorization code interception.

Definition

PKCE adds a code verifier/challenge pair to the authorization code flow. The client proves it is the same party that initiated the flow when exchanging the code for tokens, reducing interception and replay risks.

In plain English OAuth 2.0 extension (Proof Key for Code Exchange) mitigating authorization code interception.

Why this matters

Why it matters: It is a best practice for public clients (mobile/SPAs) and reduces token theft risk.

Example

Example: Use S256 code challenge method; reject plain; enforce strict redirect URI matching.