Is PKCE required when using passwordless SMS?

Help
, ,
4

Hey Ruben, Thanks for your quick reply!

I think the flow you’re describing uses a web browser since `/authorize’ should get the user to the login page. but in this case we need to use the App native UI (No web browser).

I found this post Passwordless with React Native and Auth0 which pass the code_challenge in the passwordless/start endpoint but the official api documentation does not include those params.

Also when checking at the source of react-native-auth0 I see no PKCE methods are being used when passwordlesswithSMS function is executed. react-native-auth0/index.js at master · auth0/react-native-auth0 · GitHub

I’m a bit lost here since the documentation and the examples I’ve found are conflictive. I appreciate any clarification :pray:t2:

To clarify the scenario:

  • Using auth0 vía API’s from the device (Not the SDK)
  • In react native, without any web-browser view.
  • using Passwordless SMS/OTP.