OAuth 2.0 PKCE Flow Debugger

PKCE (Proof Key for Code Exchange) is a security extension to OAuth 2.0 that protects against authorization code interception attacks. It replaces the client_secret for public clients (SPAs, mobile apps) by using a cryptographically random code_verifier and its SHA-256 hash (code_challenge) that prove the same client that started the flow is completing it.

The code_verifier is a cryptographically random string (43-128 characters) generated fresh for each authorization request. The code_challenge is the BASE64URL-encoded SHA-256 hash of the code_verifier. You send the challenge in the authorization request and the verifier in the token exchange request.

Per RFC 7636, the code_verifier must only use unreserved URI characters: A-Z, a-z, 0-9, hyphen, period, underscore, and tilde. It must be between 43 and 128 characters long. Do NOT use base64 standard encoding — use base64url (URL-safe, no padding).

For a SPA, the redirect_uri is typically the same origin as your app, e.g. `https://myapp.com/callback`. During development, `http://localhost:3000/callback` is commonly used. The exact URI must match what's registered in your OAuth provider's settings.

Yes — that's the point. PKCE was designed for public clients that cannot safely store a client_secret. The code_verifier/challenge pair provides equivalent security guarantees for single-use authorization codes without requiring a secret embedded in client-side code.