What IETF RFC 7636 - Proof Key for Code Exchange (PKCE): OAuth 2.0 Authorization Code Security Extension requires
RFC 7636 (September 2015) defines Proof Key for Code Exchange (PKCE), a security extension to the OAuth 2.0 Authorization Code Grant that prevents authorization code interception attacks for public clients (mobile apps, single-page apps, CLI tools); the client generates a cryptographic code_verifier (random string 43-128 characters), derives a code_challenge (SHA-256 hash, base64url-encoded), sends the challenge at authorization time, and proves possession of the verifier at token exchange time; PKCE is mandatory in OAuth 2.1, recommended by current IETF security BCP for all OAuth clients including confidential clients, and required by AI agent tool authentication flows where redirect URIs cannot be reliably protected.
Pillar: Workflow Automation · Authority: Internet Engineering Task Force (IETF) - OAuth Working Group · Version: 1.0.0 · Last updated:
Primary source: https://www.rfc-editor.org/rfc/rfc7636
SHA-256 integrity: 069c9346eb9bdcb3cc15359da0d01bc96a40b16c0750c95cad20815c4294cacb
Primary Citations — 7 traced to source
- {"source":"IETF RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients (September 2015)","url":"https://www.rfc-editor.org/rfc/rfc7636","section":"Sections 1-7 - complete specification including motivation, code verifier generation, challenge derivation, authorization and token request parameters, and security analysis"}
- {"source":"RFC 7636 Section 4 - Protocol","url":"https://www.rfc-editor.org/rfc/rfc7636#section-4","section":"Section 4.1 - client creates code verifier; Section 4.2 - client creates code challenge; Section 4.3 - authorization request; Section 4.5 - token request; Section 4.6 - server verifies code verifier"}
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/ietf-rfc-7636-pkce-proof-key-code-exchange-2015.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/ietf-rfc-7636-pkce-proof-key-code-exchange-2015.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/ietf-rfc-7636-pkce-proof-key-code-exchange-2015
- Back to registry: Browse all 10,085 compliance nodes