https://nalar.dev/tags/pkce/ Recent content in PKCE on Nalar Hugo en-us Wed, 16 Sep 2026 00:00:00 +0700 https://nalar.dev/pkce-binds-oauth-authorization-codes-to-a-per-request-verifier/ Wed, 16 Sep 2026 00:00:00 +0700 https://nalar.dev/pkce-binds-oauth-authorization-codes-to-a-per-request-verifier/ <p>A native application starts an OAuth authorization flow in the system browser, then waits for the operating system to route the redirect back to the app. The authorization endpoint is protected by TLS, yet the returned authorization code crosses a different boundary: application dispatch on the local device. Another application able to receive that redirect may obtain the code before the intended client does.</p> <p>Proof Key for Code Exchange, or PKCE, changes the value of that intercepted code. The client creates a transaction-specific secret called the <code>code_verifier</code>, sends only a derived <code>code_challenge</code> in the authorization request, and later presents the verifier when redeeming the code. The authorization server binds the challenge to the issued code. Possession of the code alone is then insufficient for redemption.</p>