#public-clients

PKCE Turns an Intercepted OAuth Code Into a Dead End

PKCE binds an OAuth authorization code to the client that requested it, so an intercepted code cannot be exchanged for tokens. Here is the mechanism, a local test exchange, and the trade-offs.