Authorization Code Flow with PKCE
also called PKCE
The OAuth flow recommended for all client types, in which an authorisation code is exchanged for tokens using a proof key that binds the exchange to the original requester.
The flow: the client generates a random verifier, sends its hash (the challenge) with the authorisation request, receives a code at its redirect URI, then exchanges the code for tokens while presenting the original verifier. The authorisation server checks the hash matches.
What that prevents is code interception. On mobile and in browsers, a redirect can be observed or a redirect URI hijacked by a malicious application; an intercepted code is useless without the verifier, which never left the legitimate client.
The current guidance, which has changed and is worth stating clearly: PKCE is recommended for every client type, including confidential server-side clients that also hold a secret. It is no longer the "public client" variant.
What it replaced: the implicit flow, which returned tokens directly in the URL fragment, is deprecated — tokens leaked through browser history, referrer headers and logs. Any guidance still recommending it is out of date.
The checks that must accompany it: exact-match redirect URI registration (wildcards reintroduce
hijacking), the state parameter for CSRF protection, and short-lived single-use codes.