🔑

OAuth 2.0 PKCE Flow

Medium

Free preview · 2 of 5 steps

The public client problem

Standard OAuth 2.0 authorization code flow uses a client secret to prove identity when exchanging the code for tokens. But mobile apps and browser SPAs can't keep secrets — anyone can decompile an app or read JavaScript.

PKCE (Proof Key for Code Exchange, RFC 7636) solves this: the client generates a random value, hashes it, and sends the hash upfront. When exchanging the code, it sends the original value — only the original code requestor can do this.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step