Definition
PKCE (Proof Key for Code Exchange, RFC 7636) is an OAuth 2.0/2.1 extension that prevents authorization-code interception attacks by binding the code to a client-generated secret (code_verifier).
In more depth
The client generates a random `code_verifier`, derives a `code_challenge` (SHA-256 hash of the verifier, base64url-encoded), and sends the challenge with the authorization request. The authorization server returns a code. The client exchanges the code at the token endpoint, sending the original verifier. The server validates that SHA-256(verifier) == challenge.
In OAuth 2.1, PKCE is mandatory for all clients (not just public clients). The only acceptable method is S256; the historical "plain" method is no longer allowed.
Deeper reading
Want the work, not just the definition?