PKCE (Proof Key for Code Exchange)
PKCE (Proof Key for Code Exchange), defined in RFC 7636, is an extension to the OAuth 2.0 authorization code flow that stops a stolen authorization code from being redeemed by anyone other than the client that requested it. Before starting the flow, a client generates a random code_verifier and sends a derived code_challenge (its SHA-256 hash, base64url-encoded) in the initial authorization request; when it later exchanges the authorization code for a token, it must present the original code_verifier, and the authorization server only issues a token if hashing that verifier reproduces the earlier code_challenge. The authorization code itself is often exposed somewhere a client doesn't fully control -- a mobile OS's shared redirect handling, a browser history entry, a proxy log -- so without PKCE, anyone who intercepts that code could redeem it for a token before the legitimate client does; PKCE closes that gap because the code_verifier never travels alongside the code it's redeemed with. PKCE was originally meant for public clients that can't hold a client secret, such as mobile and single-page apps, but OAuth 2.1 makes it mandatory for every client, confidential or not, and the MCP authorization specification -- itself built on OAuth 2.1 -- requires it for the same reason.
By AdminKit team, Netbase JSC · Updated