PKCE

PKCE (pronounced "pixie") is an extension to the OAuth authorization code flow for clients that cannot keep a secret, such as single-page apps and mobile apps. It binds the authorization code to the client that requested it, so intercepting the code on its way back is not enough to exchange it for a token.

How it works

Before redirecting the user, the client generates a random code_verifier and sends only its SHA-256 hash, the code_challenge, with the authorization request. When it later exchanges the code for a token, it sends the original verifier. The server hashes it, compares it with the stored challenge and issues a token only if they match.

The misconception

That PKCE is only for mobile apps. Current OAuth security guidance recommends it for every client using the authorization code flow, confidential server-side ones included, because it also defends against authorization code injection.

Try it here

The Modern Identity API implements real S256 PKCE: POST /identity/v1/authorize with a codeChallenge, then POST /identity/v1/token with the codeVerifier — a verifier that does not hash to the challenge is refused with 400 invalid_grant.

Related

• OAuth 2.0
• Modern Identity API docs

Other terms

• Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
• REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
• ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
• HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
• Bearer token — A credential where possession alone grants access — whoever holds it can use it.
• JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 2 October 2026