PKCE

ELI5 — The Vibe Check

PKCE (pronounced 'pixy') prevents someone from stealing your OAuth authorization code and using it. Before starting the OAuth flow, your app creates a secret puzzle. After getting the auth code, it proves it made the original puzzle. An interceptor can't solve the puzzle. Now required for ALL OAuth flows.

Real Talk

PKCE is an OAuth 2.0 extension that mitigates authorization code interception attacks. The client generates a random code_verifier, sends its hash (code_challenge) in the authorization request, and presents the original code_verifier when exchanging the code for tokens. The server verifies the relationship.

When You'll Hear This

"PKCE is mandatory for public clients — SPAs and mobile apps must use it." / "Even confidential clients should use PKCE as defense in depth."