IETF OAuth · Protocol
Proof Key for Code Exchange by OAuth Public Clients (PKCE)
Binds an authorization code to the client that requested it with a one-time verifier, so an intercepted code cannot be redeemed by someone else.
PublishedProposed StandardCanonical documentrfc7636
Revisions
- rfccurrent
Relations 3
Proof Key for Code Exchange by OAuth Public Clients (PKCE) builds on 1
- The OAuth 2.0 Authorization FrameworkpublishedExtends the authorization code grant with a code verifier.Source
Proof Key for Code Exchange by OAuth Public Clients (PKCE) is built on by 2
- The OAuth 2.1 Authorization FrameworkWG draftMakes PKCE a requirement of the authorization code grant.Source
- MCP AuthorizationpublishedPKCE with S256 is required for every authorization request.Source
Defines in the shared model
No features of this document are recorded yet. Features are what the atlases observe and the explorer cites; they are added as the products need them.