# Implementing PKCE with email password login for iOS

**URL:** <https://community.auth0.com/t/implementing-pkce-with-email-password-login-for-ios/124813>\
**Category:** Get Help\
**Tags:** sdks-quickstarts, auth0-swift\
**Created:** [January 15, 2024, 6:41am UTC](https://community.auth0.com/t/implementing-pkce-with-email-password-login-for-ios/124813 "2024-01-15T06:41:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sayed](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sayed/32/53932_2.png) [@sayed](https://community.auth0.com/u/sayed)\
**Post date:** [January 15, 2024, 6:41am UTC](https://community.auth0.com/t/implementing-pkce-with-email-password-login-for-ios/124813/1 "2024-01-15T06:41:54Z")

</div>

I am trying to implement PKCE for login with email and password. For that, I see this function `codeExchange(withCode:codeVerifier:redirectURI:)` but I don’t find any way to make this work with the login function I am currently using which is `login(usernameOrEmail:password:realmOrConnection:audience:scope:)`. Would like to know if this login function already following PKCE under the hood. If it’s not how to make it work?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [January 19, 2024, 5:44pm UTC](https://community.auth0.com/t/implementing-pkce-with-email-password-login-for-ios/124813/3 "2024-01-19T17:44:47Z")

</div>

Hi @sayed,

Welcome to the Auth0 Community!

The login method you’ve posted here is for the `password-realm` [extension grant](https://auth0.com/docs/get-started/applications/application-grant-types#auth0-extension-grants).

This grant is entirely separate from PKCE. If you are passing the username/password directly from your application, you are _not using the Auth Code + PKCE grant_.

The auth code + PKCE grant is specifically for redirect-based login. There’s a good diagram here: [Authorization Code Flow with Proof Key for Code Exchange (PKCE)](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-proof-key-for-code-exchange-pkce).

---

<div class="post-metadata">

**Author:** ![sayed](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sayed/32/53932_2.png) [@sayed](https://community.auth0.com/u/sayed)\
**Post date:** [February 2, 2024, 8:31am UTC](https://community.auth0.com/t/implementing-pkce-with-email-password-login-for-ios/124813/4 "2024-02-02T08:31:05Z")

</div>

Hi @dan.woda

Thanks for the reply. It helped us to clarify our understanding.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 16, 2024, 8:31am UTC](https://community.auth0.com/t/implementing-pkce-with-email-password-login-for-ios/124813/5 "2024-02-16T08:31:28Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.