PKCE (Proof Key for Code Exchange)

For SPAs and mobile apps without a backend, the client_secret would have to live in user-viewable code — which means it isn't a secret. PKCE (RFC 7636) replaces the secret with a per-flow proof.

1. Client generates a random code_verifier (43-128 chars).
2. Client computes code_challenge = base64url(SHA-256(code_verifier))
3. In the authorization URL, send code_challenge + code_challenge_method=S256.
4. After getting the auth code, exchange it WITH the original code_verifier:
   POST /token { code, code_verifier, ... }
5. Server checks SHA-256(code_verifier) matches code_challenge.

If an attacker intercepts the auth code, they can't redeem it without the code_verifier (which lives only in the original client's memory).

Originally for mobile apps; now recommended for ALL clients including web backends. OAuth 2.1 makes PKCE mandatory.

The S256 method is the standard. The plain method (challenge = verifier) exists for compatibility but is insecure — never use it.