Great post showing the difference between the new PKCE and the old Implicit grant flow!
So for Universal Login, I should go for new auth-spa-js that provides the PKCE for free.
But, if I want to go for Embedded Login, should I use the old auth0.js or is there a way to use the new SDK with PKCE for embedded login? (Supposing would be like getTokenSilently passing the credentials)