Authorization Code + PKCE
How the browser sign-in flow prevents a stolen authorization response from being reused by another client.
What PKCE does
Before sign-in, the client creates a one-time verifier and a derived challenge. Identity receives the challenge with the authorization request. When the authorization response is completed, the original verifier is required to finish the transaction.
Use the supported SDK
After the G7 Packages release is available, use the supported Auth SDK contract documented here. Do not substitute an unrelated npmjs.org package or copied snapshot.
Configuration checklist
- PKCE is enabled for the public application in Console.
- The callback URI exactly matches the registered redirect.
- Each sign-in attempt receives new state and PKCE values.
- Failed or replayed callbacks are rejected instead of retried with reused values.
Was this page useful?