PKCE, short for Proof Key for Code Exchange, is an OAuth safeguard for public clients such as browser-based apps, mobile apps, and desktop apps. During login, the client creates a secret verifier and sends a derived challenge with the authorization request. When the authorization code returns, the client must present the original verifier to redeem it.
This matters because it blocks common interception attacks. If an attacker steals an OAuth authorization code through a malicious extension, proxy, or redirect leak, the code alone is not enough to obtain tokens without the verifier. PKCE does not stop token theft after issuance, but it greatly reduces the value of intercepted codes. Defenders use PKCE to make browser OAuth flows safer, especially when the client cannot keep a traditional client secret. It is now a core control for modern login and single-sign-on designs.