OAuth PKCE: Binding Authorization Codes to the Client That Asked for Them
PKCE turns an intercepted authorization code into a dead end by binding it to a client-generated secret. Here is how the flow works, where enforcement still varies, and how to check your server.