Proof Key for Code Exchange - PKCE

v1.0.0

Proof Key for Code Exchange (abbreviated PKCE, pronounced “pixie”) is an extension to the authorization code flow to prevent CSRF and authorization code injection attacks. The technique involves the client first creating a secret on each authorization request, and then using that secret again when exchanging the authorization code for an access token. This way if the code is intercepted, it will not be useful since the token request relies on the initial secret.

For more info: 

https://www.oauth.com/oauth2-servers/pkce/

https://oauth.net/2/pkce/