PKCE Flow
1
2
3
4
Create a secret code verifier and code challenge
Build the authorization URL and redirect the user to the authorization server
After the user is redirected back to the client, verify the state
Exchange the authorization code and code verifier for an access token
1. Create a Code Verifier and Challenge
Before we can start the authorization process, we need to create a code verifier and a code challenge. The code verifier is a cryptographically random string that is used to verify the identity of the client. The code challenge is a hashed version of the code verifier, which is sent to the authorization server. The authorization server will then compare the code challenge with the code verifier to verify the identity of the client.
Generate Code Verifier
Now that we habe the code verified, we need to create the code challenge. We do so by hashing the code verifier using the SHA256 algorithm and then encoding it using the URL-safe Base64 encoding.
Generate Code Challenge
Now that we have the code verifier and code challenge, we can start the authorization process.