Proof Key for Code Exchange: A developer’s guide
OAuth 2.0’s authorization code flow relies on a client secret to prove the client’s identity when exchanging an authorization code for tokens. But what happens when your “client” is a mobile app, a single-page app, or a CLI tool? (environments where you can’t safely store secrets) That’s where PKCE (Proof Key for Code Exchange) comes…