What IETF RFC 7636 - Proof Key for Code Exchange (PKCE): OAuth 2.0 Authorization Code Security Extension requires
RFC 7636 (September 2015) defines Proof Key for Code Exchange (PKCE), a security extension to the OAuth 2.0 Authorization Code Grant that prevents authorization code interception attacks for public clients (mobile apps, single-page apps, CLI tools); the client generates a cryptographic code_verifier (random string 43-128 characters), derives a code_challenge (SHA-256 hash, base64url-encoded), sends the challenge at authorization time, and proves possession of the verifier at token exchange time; PKCE is mandatory in OAuth 2.1, recommended by current IETF security BCP for all OAuth clients including confidential clients, and required by AI agent tool authentication flows where redirect URIs cannot be reliably protected.
Pillar: Workflow Automation · Authority: Internet Engineering Task Force (IETF) - OAuth Working Group · Version: 1.0.0 · Last updated:
Primary source: https://www.rfc-editor.org/rfc/rfc7636
SHA-256 integrity: 53b4be0043f337a07dec7b298cb51ee41a1e0ffc4fde811b711a04d2f1281139
Primary Citations — 7 traced to source
- Sections 1-7 - complete specification including motivation, code verifier generation, challenge derivation, authorization and token request parameters, and security analysis — Sections 1-7 - complete specification including motivation, code verifier generation, challenge derivation, authorization and token request parameters, and security analysis
- Section 4.1 - client creates code verifier; Section 4.2 - client creates code challenge; Section 4.3 - authorization request; Section 4.5 - token request; Section 4.6 - server verifies code verifier — Section 4.1 - client creates code verifier; Section 4.2 - client creates code challenge; Section 4.3 - authorization request; Section 4.5 - token request; Section 4.6 - server verifies code verifier
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/ietf-rfc-7636-pkce-proof-key-code-exchange-2015.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/ietf-rfc-7636-pkce-proof-key-code-exchange-2015.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/ietf-rfc-7636-pkce-proof-key-code-exchange-2015
- Back to registry: Browse all 10,099 compliance nodes