# Does Authorization Code Flow with PKCE expose the Access Token to the client? **URL:** \ **Category:** Get Help\ **Tags:** documentation-request, customer-feedback\ **Created:** [February 15, 2024, 6:16am UTC](https://community.auth0.com/t/does-authorization-code-flow-with-pkce-expose-the-access-token-to-the-client/127384 "2024-02-15T06:16:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mm4242](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mm4242/32/48588_2.png) [@mm4242](https://community.auth0.com/u/mm4242)\ **Post date:** [February 15, 2024, 6:16am UTC](https://community.auth0.com/t/does-authorization-code-flow-with-pkce-expose-the-access-token-to-the-client/127384/1 "2024-02-15T06:16:53Z")
I find that two statements on the following pages contradict each other: 1. In the [overview page](https://auth0.com/docs/get-started/authentication-and-authorization-flow/which-oauth-2-0-flow-should-i-use) you state: > we recommend using the Authorization Code Flow with PKCE because the Access Token is not exposed on the client side 1. But on the [documentation page for Authorization Code Flow with PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) the diagramm suggests, that the Acsess Token is returned to the app. Because the app runs in the browser, this would mean that the Access Token is exposed to the client. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [February 15, 2024, 11:53pm UTC](https://community.auth0.com/t/does-authorization-code-flow-with-pkce-expose-the-access-token-to-the-client/127384/3 "2024-02-15T23:53:45Z")
Hey there @mm4242 welcome to the community! This language is referring to how access tokens are acquired in particular - Prior to the authorization code flow the [implicit flow](https://auth0.com/docs/authenticate/login/oidc-conformant-authentication/oidc-adoption-implicit-flow) was commonplace. In this flow access tokens are returned as a url param in the response, and therefore exposed to the client. Hope this helps to clarify! ---
**Author:** ![mm4242](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mm4242/32/48588_2.png) [@mm4242](https://community.auth0.com/u/mm4242)\ **Post date:** [February 17, 2024, 7:07am UTC](https://community.auth0.com/t/does-authorization-code-flow-with-pkce-expose-the-access-token-to-the-client/127384/4 "2024-02-17T07:07:34Z")
Hi, thanks to your response! So, I understand, when using PKCE-enhanced Authorization Code Flow the access token is **not** returned to the app i.e. browser. This flow is more secure, because the access token is never visible in the browser. But then the [diagram on this page](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) is not correct, because it tells, that the access token is returned to the app i.e. browser. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [February 22, 2024, 12:11am UTC](https://community.auth0.com/t/does-authorization-code-flow-with-pkce-expose-the-access-token-to-the-client/127384/5 "2024-02-22T00:11:52Z")
No problem, happy to help where I can! Sorry for the delayed response here - The diagram is correct as tokens are returned to the app, they are just not exposed in transit as url params with auth code/pkce flow as they are in the implicit flow. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 7, 2024, 12:12am UTC](https://community.auth0.com/t/does-authorization-code-flow-with-pkce-expose-the-access-token-to-the-client/127384/6 "2024-03-07T00:12:12Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.