# Any examples of PKCE flow in Rust? **URL:** \ **Category:** Dev to Dev Hub\ **Tags:** other, missing-category\ **Created:** [March 8, 2024, 5:05pm UTC](https://community.auth0.com/t/any-examples-of-pkce-flow-in-rust/129275 "2024-03-08T17:05:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ZizoAdam](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/zizoadam/32/55488_2.png) [@ZizoAdam](https://community.auth0.com/u/ZizoAdam)\ **Post date:** [March 8, 2024, 5:05pm UTC](https://community.auth0.com/t/any-examples-of-pkce-flow-in-rust/129275/1 "2024-03-08T17:05:33Z")
Most of the relevant code I have tried thus far > **Code** > > > **Code verifier** > > > > ```rust > > fn code_verifier() -> String { > > use base64::prelude::{Engine, BASE64_URL_SAFE}; > > let window = web_sys::window().unwrap(); > > let crypto = window.crypto().unwrap(); > > let mut rand_buffer = [0u8; 32]; > > let rand_bytes = crypto.get_random_values_with_u8_array(&mut rand_buffer); > > assert!(rand_bytes.is_ok()); > > BASE64_URL_SAFE.encode(rand_buffer) > > } > > > > fn code_verifier() -> String { > > use rand::distributions::Alphanumeric; > > use rand::{thread_rng, Rng}; > > > > thread_rng() > > .sample_iter(&Alphanumeric) > > .take(32) > > .map(char::from) > > .collect() > > } > > > > ``` > > > **B64 Encode** > > > > ```rust > > fn b64_encode(input: &str) -> String { > > use base64::prelude::BASE64_URL_SAFE_NO_PAD; > > > > BASE64_URL_SAFE_NO_PAD > > .encode(input) > > .replace('=', "") > > .replace('+', "-") > > .replace('/', "_") > > } > > > > ``` > > > **Sha256** > > > > I had another using [Sha256](https://crates.io/crates/sha256) but forgot to save it anywhere, I doubt it’s the culprit. > > > > ```rust > > fn sha256(input: &str) -> String { > > use cryptoxide::digest::Digest; > > use cryptoxide::sha2::Sha256; > > > > let mut hasher = Sha256::new(); > > hasher.input_str(input); > > hasher.result_str() > > } > > > > ``` > > > **Requests** > > > > The application is built using Leptos with CSR, for context. > > > > This works fine as far as I can tell, I get a code and the verifier is stored (not sure if this is particularly safe, but the application isn’t public yet so I can change it later) to be reused > > > > ```rust > > #[component] > > pub fn LoginPanel() -> impl IntoView { > > let code_verifier = code_verifier(); > > let code_challenge = b64_encode(&sha256(&code_verifier)); > > > > let url = url::Url::parse_with_params( > > "{domain}/authorize", > > vec![ > > ("response_type", "code"), > > ("code_challenge", &code_challenge), > > ("code_challenge_method", "S256"), > > ("client_id", "{client_id}"), > > ("redirect_uri", "http://127.0.0.1:8081/auth"), > > ("scope", "openid profile email"), > > ("audience", "{audience}"), > > ], > > ) > > .unwrap() > > .to_string(); > > > > use_local_storage::("code_verifier") > > .1 > > .set(code_verifier); > > > > view! { > >
> > > > "Login" > > > >
> > } > > } > > > > ``` > > > > The next step is where things go awry, I get a 401 error with no details. > > > > ```rust > > #[component] > > fn Auth() -> impl IntoView { > > let code_verifier = use_local_storage::("code_verifier") > > .0 > > .get_untracked(); > > > > let code = web_sys::UrlSearchParams::new_with_str( > > &web_sys::window().unwrap().location().search().unwrap(), > > ) > > .unwrap() > > .get("code") > > .unwrap(); > > > > spawn_local(async move { > > let url = url::Url::parse_with_params( > > "{domain}/oauth/token", > > vec![ > > ("grant_type", "authorization_code"), > > ("client_id", "{client_id}"), > > ("code_verifier", code_verifier.as_str()), > > ("code", code.as_str()), > > ("redirect_uri", "{redirect_uri}"), > > ], > > ) > > .unwrap(); > > > > let response = reqwasm::http::Request::post(url.as_str()) > > .header("content-type", "application/x-www-form-urlencoded") > > .send() > > .await; > > > > log!("{:?}", response); > > }); > > > > view! { > >
"Auth"
> > } > > } > > > > ``` I’m following [https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce/call-your-api-using-the-authorization-code-flow-with-pkce) in Rust, but when trying to call `oauth/token` I get a 401 error with no real details and nothing in the logs for me to understand why it’s happening. Has anyone done this themselves without the Auth0 package/library that is willing to share an example, or can explain what I’m doing wrong here? ---
**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\ **Post date:** [April 8, 2025, 5:02pm UTC](https://community.auth0.com/t/any-examples-of-pkce-flow-in-rust/129275/3 "2025-04-08T17:02:52Z")
Hi @ZizoAdam, Welcome to the Auth0 Community and sorry for the late reply! In order to use Rust within Auth0 i would recommend following up this [documentation](https://auth0.com/docs/get-started/architecture-scenarios/server-application-api/part-3) about **Application Implementation (Server Apps + API)** which explains that: > You need to implement a middleware function within your API application to handle tokens. This function checks if a token was included with the API request, validates the token, and then confirms if the scope(s) required to perform the requested action are present. Otherwise a `HTTP 401 Unauthorized` status code will be presented. There aren’t lots of up to date examples, but this [blog post](https://auth0.com/blog/build-an-api-in-rust-with-jwt-authentication-using-nickelrs/#Implementing-JWT-Authentication-for-the-Rust-API) provides step by step instructions on how to set up an **API in Rust with JWT Authentication using Nickel.rs** , including a **middleware** function example. Hope this helps. Thanks, Remus ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [April 22, 2025, 5:02pm UTC](https://community.auth0.com/t/any-examples-of-pkce-flow-in-rust/129275/4 "2025-04-22T17:02:56Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed. ---
**Author:** ![remus.ivan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/remus.ivan/32/68771_2.png) [@remus.ivan](https://community.auth0.com/u/remus.ivan)\ **Post date:** [September 5, 2025, 8:38pm UTC](https://community.auth0.com/t/any-examples-of-pkce-flow-in-rust/129275/5 "2025-09-05T20:38:20Z")