--- title: "Proof Key for Code Exchange — Identity Glossary | IDSync" description: "Proof Key for Code Exchange (PKCE, pronounced 'pixie') is an OAuth 2.0 extension (RFC 7636) that protects the authorization code flow from interception…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Proof Key for Code Exchange", "item": "https://idsync.com/glossary/pkce" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/pkce", "name": "Proof Key for Code Exchange", "alternateName": [ "PKCE", "PKCE", "Pixie" ], "description": "Proof Key for Code Exchange (PKCE, pronounced 'pixie') is an OAuth 2.0 extension (RFC 7636) that protects the authorization code flow from interception attacks by requiring the client to prove it initiated the original authorization request.", "url": "https://idsync.com/glossary/pkce", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Proof Key for Code Exchange Standards # Proof Key for Code Exchange (PKCE) Proof Key for Code Exchange (PKCE, pronounced 'pixie') is an OAuth 2.0 extension (RFC 7636) that protects the authorization code flow from interception attacks by requiring the client to prove it initiated the original authorization request. Last reviewed 3 months ago Key points - PKCE replaces the OAuth implicit flow for SPAs and mobile apps — the implicit flow is officially deprecated. - Flow: client generates a random code\_verifier, sends SHA-256(code\_verifier) as code\_challenge with the auth request, then proves possession by sending the raw code\_verifier when exchanging the code for tokens. - Required for public clients (mobile, SPA, CLI). Recommended for all OAuth clients in OAuth 2.1. - Defends against authorization-code interception (malicious app on the same device, browser history leaks, log files). - Modern IdPs (Okta, Auth0, Entra ID, Google, Cognito, Keycloak) all support PKCE. ## What is PKCE? Proof Key for Code Exchange (PKCE, RFC 7636, pronounced "pixie") is the OAuth 2.0 extension that makes the **authorization code flow** safe to use without a client secret — which is exactly the situation every mobile app, single-page app, CLI, and desktop app is in. Before PKCE, public clients had two bad options: use the implicit flow (which returned tokens directly in URL fragments — leaky and unrevokable) or hardcode a "client secret" that wasn't actually secret. PKCE solves both. ## How it works 1. Client generates a random **`code_verifier`** — 43–128 chars of high-entropy randomness. 2. Client computes **`code_challenge` = BASE64URL(SHA-256(code\_verifier))** and sends it with the authorization request, along with `code_challenge_method=S256`. 3. The authorization server stores the challenge against the issued authorization code. 4. When the client exchanges the code for tokens, it sends the original `code_verifier`. 5. The server hashes it, compares to the stored challenge, and only issues tokens if they match. Result: even if an attacker intercepts the authorization code (via a malicious app handling the redirect URI, browser history, or a leaked log line), they can't redeem it because they don't have the verifier. ## When to use it **Always**, in OAuth 2.1. Specifically: - **Mobile and native apps** — mandatory. - **Single-page apps (SPAs)** — mandatory. PKCE replaced the implicit flow here. - **Confidential clients (backend web apps with a client secret)** — recommended. Defense in depth: a stolen client secret alone isn't enough to redeem stolen codes. ## Common misconceptions - **"PKCE replaces a client secret."** Partially — for public clients, yes. For confidential clients, you use both. - **"PKCE prevents phishing."** No. It prevents authorization-code interception. Phishing-resistant MFA (FIDO2) prevents phishing. - **"`plain` method is fine."** Don't. Always use `S256`. Some IdPs reject `plain` outright. ## Editorial note If you're evaluating an IdP and it doesn't support PKCE, walk away. Every credible OAuth provider has supported it for years. If you're building an OAuth client, use a vetted library (AppAuth, MSAL, oauth4webapi) rather than rolling your own — getting PKCE right is easy, getting _all_ of OAuth right is not. ## Standards & references - [RFC 7636 — PKCE](https://datatracker.ietf.org/doc/html/rfc7636) - [OAuth 2.1 draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [authorization](/directory/category/authorization) ### Related terms [oauth 2](/glossary/oauth-2)[openid connect](/glossary/openid-connect)[authorization code flow](/glossary/authorization-code-flow) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the authorization category. [Explore tools](/directory/category/authorization) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.