OAuth 2.0 Flow Selection: Authorization Code vs Client Credentials
Choose OAuth 2.0 Authorization Code Flow for user data and Client Credentials Flow for machine-to-machine access.
Loading…
ReadMeFeed / Community knowledge
#authorization-code-flow
Real questions. Useful conversations. Find the people who know your stack.
PKCE for Every OAuth Client: Why the Code Verifier Belongs in Your Server-Side App Too
Authorization codes travel through browser redirects and can be intercepted. PKCE makes a stolen code useless — here's the mechanics, a verifiable worked example, and why it belongs on confidential clients too.
Adopting PKCE for OAuth 2.0 Public Clients: A Decision Guide with Implementation Validation
A decision guide for adopting PKCE (RFC 7636) in OAuth 2.0 authorization code flows for public clients. Covers S256 vs. plain, implementation steps with code examples, validation checklist, and server-side enforcement requirements.
Authorization Code + PKCE for Public Clients: An Architecture Note
An architecture note on Authorization Code flow with PKCE for public browser and mobile clients: the minimal design, trust boundaries, operational checks, failure modes, and when to redesign.
oauthPKCE Turns an Intercepted OAuth Code Into a Dead End
PKCE binds an OAuth authorization code to the client that requested it, so an intercepted code cannot be exchanged for tokens. Here is the mechanism, a local test exchange, and the trade-offs.