Skip to content
masterclassBuddyTech Buzz5 fresh blogs · 5:00 AM IST
Start learning

Kinde · Const

PKCE

PKCE is Kinde’s secure Authorization Code variant for public clients such as SPAs and mobile apps. It replaces a stored client secret with a verifier-and-challenge proof.

How it works

PKCE extends Kinde’s authorization-code flow for clients that cannot safely keep a client secret. The client creates a random verifier, sends a transformed challenge during authorization, and later proves possession by presenting the original verifier when exchanging the authorization code for tokens.

Syntax

Authorization Code flow with PKCE: code_challenge + code_challenge_method in the authorization request; code_verifier in the token request

Parameters

NameTypeDescription
code_verifierstringRandom secret generated by the client and later presented to prove possession.
code_challengestringHashed representation of the verifier sent in the authorization request.
code_challenge_methodstringTransformation used to create the challenge; Kinde documentation specifies SHA-256/S256.

Returns

An authorization code that can be exchanged for tokens after the client proves possession of the code verifier.

Key points

  • Kinde supports PKCE as an extension of its OAuth authorization-code flow.
  • The documentation recommends PKCE for mobile applications and single-page applications.
  • PKCE removes the need to send a client secret by using a one-time proof tied to the authorization request.
  • The client generates a random verifier and sends its hashed form as the challenge.
  • A Kinde authorization URL should carry PKCE parameters together with state and nonce values.

Common mistakes

  • Do not substitute the Implicit Flow for a front-end application; Kinde supports Authorization Code with PKCE instead.
  • A PKCE authorization request must include both the challenge and the challenge-method parameters.

Example: Create a Kinde PKCE authorization request

const verifier = crypto.randomUUID();
const challenge = await crypto.subtle.digest(
  "SHA-256",
  new TextEncoder().encode(verifier),
);
const codeChallenge = btoa(String.fromCharCode(...new Uint8Array(challenge)))
  .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

const authorizationUrl = new URL("https://yourbusiness.kinde.com/oauth2/auth");
authorizationUrl.search = new URLSearchParams({
  client_id: "YOUR_CLIENT_ID",
  redirect_uri: "https://example.com/callback",
  response_type: "code",
  scope: "openid email offline",
  code_challenge: codeChallenge,
  code_challenge_method: "S256",
}).toString();

console.log(authorizationUrl.toString());

Generates a verifier, derives its SHA-256 challenge, and adds the PKCE parameters to a Kinde authorization request.

When to use it

Single-page applications

A browser-based SPA needs OAuth sign-in without exposing a client secret.

Mobile authentication

A mobile app authenticates users while keeping credentials out of shipped client code.

Front-end OAuth

A front-end application needs Kinde authorization-code login instead of the unsupported Implicit Flow.

Interview questions

QWhat problem does PKCE solve?

PKCE is an extension to the Authorization Code flow that replaces the client secret with a one-time cryptographic proof. The application generates a code verifier, sends a hashed code challenge to Kinde, and later supplies the verifier during token exchange.

Follow-up: Why is PKCE useful for a single-page application? It avoids depending on a client secret that client-side code cannot securely keep.

QWhich values are required in a Kinde PKCE request?

Kinde requires code_challenge and code_challenge_method when using its PKCE extension. The recommended method shown in the documentation is SHA-256, represented in authorization requests as S256.

Follow-up: What must the client preserve after creating the authorization request? It must retain the original verifier so it can present it during the token request.

QWhich application types should use PKCE?

PKCE is recommended for mobile applications and single-page applications. It is also suitable for front-end applications because it does not require embedding a client secret in exposed client-side code.

Follow-up: What flow should a Kinde front-end application avoid? It should avoid the Implicit Flow, which Kinde does not support for front-end apps.

  • Authorization Code Flow
  • code_challenge
  • code_challenge_method
  • code_verifier
  • state
  • nonce
  • Implicit Flow
  • Authorization Code (With PKCE)

Source: Use Kinde without an SDK. Checked 2026-10-15.