Proof Key for Code Exchange (PKCE)

Concept

An OAuth extension defined in RFC 7636 in which the client creates a one-time secret at the start of sign-in and must present it when redeeming the authorization code, protecting against code interception.

Title graphic: Proof Key for Code Exchange (PKCE) (Concept)

Type	Concept

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Profile: www.rfc-editor.org/info/rfc7636

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-03