Topic: oauth

• OAuth 2.0 authorization code flow with PKCE for public clients

  A public client (single-page app, native or CLI app) cannot keep a client secret, so it binds each authorization request to a one-off code verifier: it sends the SHA-256 hash as code_challenge, and the token endpoint releases tokens only to whoever presents the matching verifier. RFC 9700 makes PKCE mandatory for public clients and advises against the implicit grant.

  article · en · unreviewed

Machine-readable: JSON