PKCE (RFC 7636)

1. Protocol flow

   How PKCE binds the authorization code to the client.

2. Code verifier

   Generating a high-entropy code_verifier.

3. Code challenge

   Deriving code_challenge with S256 or plain.

4. Authorization request

   Sending code_challenge and code_challenge_method.

5. Access token request

   Sending code_verifier to the token endpoint.

6. Server verification

   How the server compares verifier and challenge.

7. Security considerations

   Entropy requirements, S256 vs plain and downgrade risks.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.