thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Proof Key for Code Exchange (PKCE)

OAuth extension (RFC 7636) that binds an authorization code to the client that requested it.

Definition

The client creates a random code verifier and sends its hash (code challenge) in the authorization request; it must present the verifier when redeeming the code. This stops attackers who intercept authorization codes from exchanging them. PKCE is required for public clients and recommended for all clients.

Example

A single-page app uses the authorization code flow with PKCE instead of the deprecated implicit flow.

Exam tip

Pronounced 'pixy'; it defeats authorization code interception.

Related terms