To generate a Code Verifier and Code Challenge (PKCE) in OutSystems 11 you’ll typically use a combination of random string generation and SHA‑256 + Base64URL encoding. OutSystems doesn’t have a built‑in PKCE helper, but you can build it easily with existing functions / CryptoAPI.

PKCE (RFC 7636) expects:

• code_verifier: a high‑entropy random string (43–128 chars) using characters:
  [A-Z] [a-z] [0-9] "-" "." "_" "~"
• code_challenge:
  BASE64URL( SHA256( code_verifier ) ) (when code_challenge_method = "S256")

Below is an approach you can implement in OutSystems:

1. Generate the Code Verifier

Create a server action GenerateCodeVerifier:

1. Define a local variable Chars with the allowed characters:
   Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
2. Define an input parameter Length (Integer) default 64 (for example).
3. Loop from 1 to Length:
   • For each iteration, pick a random index:
     • Use Random() or, preferably, Crypto-based random from a Forge component (e.g., CryptoAPI’s random if you have it).
   • Use Substr(Chars, Index, 1) and concatenate to Verifier.
4. Return Verifier (Text).

Result: Verifier is your code_verifier.

If you already have a crypto‑random function exposed (e.g. from CryptoAPI), use that to avoid predictable sequences.

2. Generate the Code Challenge (S256 method)

Create a server action GenerateCodeChallenge with input CodeVerifier (Text) and output CodeChallenge (Text).

Implementation outline using CryptoAPI:

1. Hash with SHA‑256

   Use CryptoAPI’s SHA‑256 function (or ComputeMac if you expose SHA256 hash in an extension):

   • Convert the verifier to binary:
     • Binary = TextToBinaryData(CodeVerifier) (or equivalent in CryptoAPI).
   • Compute SHA‑256 hash:
     • Use SHA‑256 action to get a binary result (e.g. HashBinary).

2. Base64 encode the hash

   • HashBase64 = BinaryToBase64(HashBinary)

   This gives you standard Base64 (with +, /, and possibly = padding).

3. Convert Base64 to Base64URL (PKCE requirement)

   Create another helper action Base64ToBase64Url:

   Input: HashBase64 (Text)
   Output: Base64Url (Text)

   • Replace characters:
     • Base64Url = Replace(Replace(HashBase64, "+", "-"), "/", "_")
   • Remove padding:
     • While Right(Base64Url, 1) = "=":
       • Base64Url = Left(Base64Url, Length(Base64Url) - 1)

4. Set CodeChallenge = Base64Url.

Now you have a PKCE‑compliant code_challenge for code_challenge_method = "S256".

3. Using the values in the OAuth flow

• Authorization request:
  • Send code_verifier to the client (or store it in session).
  • Send code_challenge and code_challenge_method = "S256" in the authorization request.
• Token request:
  • When exchanging the authorization code for tokens, send the original code_verifier to the IdP.

Notes specific to OutSystems 11

• Base cryptographic operations (SHA‑256, HMAC, etc.) can be done via CryptoAPI Forge component (or your own extension). SHA256 encryption using custom salt, need 64 byte response
• HMAC‑SHA256 examples in CryptoAPI and extensions show how to work with binary + Base64, which is the same pattern you need for PKCE (just without HMAC, only SHA‑256). how to generate Generate HMAC-SHA256 hash ?
• If you already use an extension for HMAC‑SHA256 or SHA‑256, you can reuse that logic; just remember to apply Base64URL transformation and remove = padding at the end.

If you describe which components (CryptoAPI version or your own extension) you are already using, I can map this to exact OutSystems actions and data types (BinaryData vs Text).