Glossary · Cryptography & authentication
PKCE
PKCE (Proof Key for Code Exchange, RFC 7636) hardens the OAuth 2.0 authorization-code flow: the client commits to a one-time secret up front, so an intercepted authorization code is useless without it.
The attack PKCE kills: authorization codes travel through browser redirects, and anything that can observe the redirect — a malicious app registered for the same URL scheme, a leaky log — could historically exchange the stolen code for tokens. With PKCE the client sends a hash (the code challenge, S256) when authorization starts and must present the preimage (the code verifier) when redeeming the code. Interceptors hold a code they cannot spend.
Originally designed for mobile apps that cannot keep a client secret, PKCE is now the recommended default for every OAuth client — OAuth 2.1 makes it mandatory. Ciphera ID requires PKCE with S256 on all authorization-code flows; the plain method is rejected.