Glossary term
What is PKCE (Proof Key for Code Exchange)?
PKCE stands for Proof Key for Code Exchange.
In System Design
Protects the OAuth code exchange from interception. Example: Required for mobile and single-page apps.
Learn it properly · System DesignLesson 50: OAuth 2.0 & OpenID Connect ExplainedApps used to ask for your Google password to print your photos. How OAuth 2.0 hands out limited, expiring, revocable “valet keys” instead, how OpenID Connect adds login on top, and the flows and checks that keep it secure.In Full-Stack Questions
A small proof added to the OAuth code flow so a stolen code cannot be used by someone else.
Learn it properly · Full-Stack QuestionsLesson 22: Auth Libraries, OAuth and OIDCOAuth vs OpenID Connect, code flow with PKCE, tokens and rotation, Auth.js and Better Auth, protecting Next.js 16, RBAC, passkeys and MFA.In API Design
An addition to the OAuth code flow where the client proves it started the login, so a stolen code is useless.
Learn it properly · API DesignLesson 6: API Authentication and Authorization: API Keys, OAuth 2.0 and ScopesAPI keys, bearer tokens, OAuth 2.0 flows in plain words, scopes, and common mistakes. Ties back to the Security series.