OAuth 2.0 PKCE (pronounced "pixy") [1] is described in RFC 7636: Proof Key for Code Exchange by OAuth Public Clients [2]: > OAuth 2.0 public clients utilizing

OAuth 2.0 PKCE (pronounced "pixy") [1] is described in RFC 7636: Proof Key for Code Exchange by OAuth Public Clients [2]: > OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat through the use of Proof Key for Code Exchange (PKCE, pronounced "pixy"). [1] https://oauth.net/2/pkce/ https://oauth.net/2/pkce/ [2] https://tools.ietf.org/html/rfc7636 https://tools.ietf.org/html/rfc7636