Handy Tools

Handy Tools

Developer Tools

PKCE Code Generator

Generate PKCE (Proof Key for Code Exchange) code verifier and challenge pairs for secure OAuth flows. Essential for public clients and SPAs.

PKCE Configuration

Configure the code challenge method

S256 is recommended for security. Plain method should only be used if SHA256 is not available.

Generated PKCE Codes

Use these codes in your OAuth PKCE flow

Click "Generate PKCE Codes" to create your code verifier and challenge

PKCE OAuth Flow

  1. 1. Client: Generate code_verifier and code_challenge
  2. 2. Authorization Request: Include code_challenge and code_challenge_method in auth URL
  3. 3. User: Authenticates and grants permissions
  4. 4. Callback: Authorization server returns authorization code
  5. 5. Token Exchange: Send authorization code + code_verifier to get tokens
  6. 6. Verification: Server verifies code_verifier matches code_challenge

Authorization Request

Add these parameters to your OAuth URL

https://auth.example.com/oauth/authorize? client_id=your_client_id& redirect_uri=your_callback& response_type=code& code_challenge=generated_challenge& code_challenge_method=S256& scope=openid profile

Token Exchange

Include code_verifier in token request

POST /oauth/token Content-Type: application/x-www-form-urlencoded grant_type=authorization_code& code=received_auth_code& client_id=your_client_id& code_verifier=generated_verifier

Why Use PKCE?

Security Benefits

  • • Prevents authorization code interception attacks
  • • No client secret required (perfect for SPAs)
  • • Cryptographically secure code verification
  • • Mitigates risks in public clients

Use Cases

  • • Single Page Applications (SPAs)
  • • Mobile applications
  • • Desktop applications
  • • Any public OAuth client