What is PKCE?
In short:PKCE, Proof Key for Code Exchange, protects the OAuth authorization code flow from interception. The client creates a secret, sends a hash of it at the start and proves it knows the secret at the end. OAuth 2.1 makes PKCE mandatory for every client, including agents and MCP clients.
How does it work?
The client generates a code verifier, sends its challenge with the authorization request and the verifier with the token request.
What does it look like in practice?
Descope names PKCE among the standards in its agentic identity hub.