Wikitopia
PKCE
conceptprotocol
Try in Playground →RSS
Overview
Developed byIETF
LicenseOpen standard
Open source✓ Open Source
Use caseOAuth 2.0 security enhancement for public clients
Technical
Protocols
OAuth 2.0
Also see
Alternative to
client secret authentication
Knowledge graph stats
Claims43
Avg confidence95%
Avg freshness100%
Last updatedUpdated yesterday
Trust distribution
100% unverified
Governance
Not assessed
Contribute governance data →

PKCE

concept

Proof Key for Code Exchange, OAuth 2.0 extension protecting public client authorization

Compare with...

supports protocol

ValueTrustConfidenceFreshnessSources
OAuth 2.0○UnverifiedHighFresh1

defined in standard

ValueTrustConfidenceFreshnessSources
RFC 7636○UnverifiedHighFresh1

integrates with

ValueTrustConfidenceFreshnessSources
OAuth 2.0 Authorization Code Flow○UnverifiedHighFresh1

defined by

ValueTrustConfidenceFreshnessSources
IETF RFC 7636○UnverifiedHighFresh1
RFC 7636○UnverifiedHighFresh1

published year

ValueTrustConfidenceFreshnessSources
2015○UnverifiedHighFresh1

extends protocol

ValueTrustConfidenceFreshnessSources
OAuth 2.0○UnverifiedHighFresh1

standardized by

ValueTrustConfidenceFreshnessSources
IETF○UnverifiedHighFresh1

open source

ValueTrustConfidenceFreshnessSources
true○UnverifiedHighFresh1

primary use case

ValueTrustConfidenceFreshnessSources
OAuth 2.0 security enhancement for public clients○UnverifiedHighFresh1
securing OAuth 2.0 authorization code flows○UnverifiedHighFresh1
securing OAuth authorization code flow for public clients (SPAs, mobile)○UnverifiedHighFresh1
Preventing authorization code interception attacks○UnverifiedHighFresh1

prevents attack type

ValueTrustConfidenceFreshnessSources
authorization code interception attack○UnverifiedHighFresh1

authored by

ValueTrustConfidenceFreshnessSources
Nat Sakimura○UnverifiedHighFresh1
John Bradley○UnverifiedHighFresh1

prevents attack

ValueTrustConfidenceFreshnessSources
authorization code interception attacks○UnverifiedHighFresh1

uses method

ValueTrustConfidenceFreshnessSources
code challenge and verifier○UnverifiedHighFresh1

governed by

ValueTrustConfidenceFreshnessSources
RFC 7636○UnverifiedHighFresh1

used by

ValueTrustConfidenceFreshnessSources
Auth0○UnverifiedHighFresh1

built on

ValueTrustConfidenceFreshnessSources
OAuth 2.0○UnverifiedHighFresh1

supported by

ValueTrustConfidenceFreshnessSources
OpenID Connect○UnverifiedHighFresh1
Auth0○UnverifiedHighFresh1
Okta○UnverifiedHighFresh1

developed by

ValueTrustConfidenceFreshnessSources
IETF○UnverifiedHighFresh1
Internet Engineering Task Force○UnverifiedHighFresh1

requires

ValueTrustConfidenceFreshnessSources
cryptographically random code verifier○UnverifiedHighFresh1

supports hash method

ValueTrustConfidenceFreshnessSources
SHA256○UnverifiedHighFresh1

designed for

ValueTrustConfidenceFreshnessSources
Public clients○UnverifiedHighFresh1

mitigates attack

ValueTrustConfidenceFreshnessSources
Authorization code interception○UnverifiedHighFresh1

uses cryptographic method

ValueTrustConfidenceFreshnessSources
SHA256 hashing○UnverifiedHighFresh1

license type

ValueTrustConfidenceFreshnessSources
Open standard○UnverifiedHighFresh1
IETF standards track○UnverifiedHighFresh1

recommended for client type

ValueTrustConfidenceFreshnessSources
mobile applications○UnverifiedHighFresh1
single-page applications○UnverifiedHighFresh1

alternative to

ValueTrustConfidenceFreshnessSources
client secret authentication○UnverifiedHighFresh1

commonly used with

ValueTrustConfidenceFreshnessSources
Mobile applications○UnverifiedHighFresh1
Single-page applications○UnverifiedHighFresh1

implemented by

ValueTrustConfidenceFreshnessSources
Auth0○UnverifiedModerateFresh1
Okta○UnverifiedModerateFresh1

supported by provider

ValueTrustConfidenceFreshnessSources
Google○UnverifiedModerateFresh1
Microsoft○UnverifiedModerateFresh1

Alternatives & Similar Tools

client secret authentication
alternative to
Compare →

Commonly Used With

OAuth 2.0 Authorization Code Flow

Related entities

Claim count: 43Last updated: 4/9/2026Edit history