PKCE
PKCE, or Proof Key for Code Exchange, is an OAuth protection that binds an authorization code exchange to a secret verifier created for that authorization request.
Why the code alone is not enough
For each authorization request, the client creates a random secret called a code verifier. It derives a code challenge and sends that with the request. With the S256 method, the challenge is a SHA-256-based transformation of the verifier.
The authorization server links the challenge to the code it issues. When the client exchanges that code, it supplies the verifier. The server checks it against the earlier challenge. An intercepted code is not enough to complete the exchange if the verifier stays secret and the server enforces the check.
PKCE does not authenticate the application’s registered identity. Confidential clients still need their required client authentication. It also does not decide whether the application should have a permission or whether someone should trust a consent prompt.
Check both ends
For the authorization code grant, current OAuth security guidance requires PKCE for public clients and recommends it for confidential clients. Check that the client library enables it and the authorization server enforces it. An authorized test using the wrong verifier should be rejected.
This protects the code exchange. It does not prevent theft of tokens issued afterward.