PKCE: protecting public clients

OAuth 2.0 Course · lesson 4 of 13 · 5 min read

A mobile app cannot keep a secret, so the code alone is not safe. PKCE fixes that.

Open this lesson in the learning hub

Key points

  • A public client - a SPA or mobile app - ships its code to the device, so a client secret is not secret.
  • Without a secret, anyone who steals the authorization code can exchange it for a token.
  • PKCE: the client invents a random verifier and sends only its hash (the challenge) up front.
  • When redeeming the code it must present the original verifier, which the attacker never saw.
  • PKCE is now recommended for all clients, including confidential ones - it costs almost nothing.

PKCE binds the code to whoever started the login, so a stolen code is worthless.

The authorization code flow Choosing a grant type

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.