# \#pkce **URL:** https://community.auth0.com/tag/pkce/365.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Native Android PKCE returns wrong access-token audience despite explicit audience and active user-delegated grant](https://community.auth0.com/t/native-android-pkce-returns-wrong-access-token-audience-despite-explicit-audience-and-active-user-delegated-grant/205173)
**Author:** [@cattleweight-auth](https://community.auth0.com/u/cattleweight-auth)\ **Replies:** 1\ **Last updated:** [November 9, 2026, 2:59pm UTC](https://community.auth0.com/t/native-android-pkce-returns-wrong-access-token-audience-despite-explicit-audience-and-active-user-delegated-grant/205173 "2026-11-09T14:59:32Z")
Hello Auth0 Community, I’m investigating unexpected access token audience behavior in a native Android application using Auth0 Authorization Code Flow with PKCE (S256). The application needs separate access tokens for … --- ## [Automated authentication using cypress with organization and PKCE](https://community.auth0.com/t/automated-authentication-using-cypress-with-organization-and-pkce/93232)
**Author:** [@augustin.riedinger](https://community.auth0.com/u/augustin.riedinger)\ **Replies:** 2\ **Last updated:** [February 25, 2026, 5:59pm UTC](https://community.auth0.com/t/automated-authentication-using-cypress-with-organization-and-pkce/93232 "2026-02-25T17:59:38Z")
This is really driving me crazy. I’m trying to implement automated tests on my vue frontend app using cypress. I read and used all articles I collected on the topic like this one or that one. Then I realized what made… --- ## [Demystifying OAuth Security: State vs. Nonce vs. PKCE](https://community.auth0.com/t/demystifying-oauth-security-state-vs-nonce-vs-pkce/195011)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [November 28, 2025, 9:26am UTC](https://community.auth0.com/t/demystifying-oauth-security-state-vs-nonce-vs-pkce/195011 "2025-11-28T09:26:58Z")
Have you ever wondered what the state, nonce, code\_challenge, and code\_verifier parameters are for in OAuth requests? This blog post will provide the answers you are looking for. --- ## [RFC 7636 violation - Weak enforcement of PKCE parameters in OAuth 2.0 implementation](https://community.auth0.com/t/rfc-7636-violation-weak-enforcement-of-pkce-parameters-in-oauth-2-0-implementation/187016)
**Author:** [@manish.singh](https://community.auth0.com/u/manish.singh)\ **Replies:** 2\ **Last updated:** [July 15, 2025, 8:54am UTC](https://community.auth0.com/t/rfc-7636-violation-weak-enforcement-of-pkce-parameters-in-oauth-2-0-implementation/187016 "2025-07-15T08:54:28Z")
Feature: Strict enforcement of PKCE parameters in OAuth 2.0 implementation Description: PKCE ( Proof Key for Code Exchange) was introduced as an extension to OAuth 2.0 to mitigate risk of authorization code interception… --- ## [How do I properly handle session timeout in PKCE using the Vue Auth0 SDK?](https://community.auth0.com/t/how-do-i-properly-handle-session-timeout-in-pkce-using-the-vue-auth0-sdk/89861)
**Author:** [@jgleason](https://community.auth0.com/u/jgleason)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 8:00pm UTC](https://community.auth0.com/t/how-do-i-properly-handle-session-timeout-in-pkce-using-the-vue-auth0-sdk/89861 "2022-09-01T20:00:32Z")
Hey everyone, Business is asking to make sure people have to go through the auth flow every n hours. My login config looks like this… { domain: "...", client\_id: "...", redirect\_uri: window.location.o… --- ## [Customize login page when using Authentication API with PKCE](https://community.auth0.com/t/customize-login-page-when-using-authentication-api-with-pkce/88171)
**Author:** [@mehir.wolde](https://community.auth0.com/u/mehir.wolde)\ **Replies:** 7\ **Last updated:** [August 13, 2022, 12:22am UTC](https://community.auth0.com/t/customize-login-page-when-using-authentication-api-with-pkce/88171 "2022-08-13T00:22:05Z")
Hi, I am currently working on a project where we are trying to implement our own login and sign up system which uses the PKCE flow. The tools we are using are react typescript and node js with an express server, all run… --- ## [Is PKCE required when using passwordless SMS?](https://community.auth0.com/t/is-pkce-required-when-using-passwordless-sms/78916)
**Author:** [@authenticator](https://community.auth0.com/u/authenticator)\ **Replies:** 3\ **Last updated:** [July 24, 2022, 7:50pm UTC](https://community.auth0.com/t/is-pkce-required-when-using-passwordless-sms/78916 "2022-07-24T19:50:07Z")
I’m authenticating users in a react native App using auth0 API but I’m not sure if PKCE is required since there’s no examples of this flow using Passwordless. I request the OTP code using the following endpoint: POST “h… --- ## [Authorization Code Flow with PKCE utilizing package Auth0.AspNetCore.Authentication](https://community.auth0.com/t/authorization-code-flow-with-pkce-utilizing-package-auth0-aspnetcore-authentication/78314)
**Author:** [@arshad.sarfarz.1979](https://community.auth0.com/u/arshad.sarfarz.1979)\ **Replies:** 5\ **Last updated:** [March 24, 2022, 1:39am UTC](https://community.auth0.com/t/authorization-code-flow-with-pkce-utilizing-package-auth0-aspnetcore-authentication/78314 "2022-03-24T01:39:56Z")
Our team would like to use Authorization Code Flow with PKCE for server side applications. Can we use the package Auth0.AspNetCore.Authentication for implementing Authorization Code Flow with PKCE in ASP.NET Core MVC? I … --- ## [Problem creating custom Twitter OAuth2 Social Connection](https://community.auth0.com/t/problem-creating-custom-twitter-oauth2-social-connection/78824)
**Author:** [@samiur](https://community.auth0.com/u/samiur)\ **Replies:** 1\ **Last updated:** [February 26, 2022, 1:00am UTC](https://community.auth0.com/t/problem-creating-custom-twitter-oauth2-social-connection/78824 "2022-02-26T01:00:15Z")
Hi there, We’re about to start using the Twitter v2 API, which requires their newly released OAuth2 auth flow. However, they seem to only support PKCE based auth flow, and require the code\_challenge and code\_challenge\_… --- ## [Empty access token payload when using PKCE](https://community.auth0.com/t/empty-access-token-payload-when-using-pkce/78581)
**Author:** [@chris36](https://community.auth0.com/u/chris36)\ **Replies:** 2\ **Last updated:** [February 20, 2022, 9:02am UTC](https://community.auth0.com/t/empty-access-token-payload-when-using-pkce/78581 "2022-02-20T09:02:52Z")
I’ve been trying to setup a SPA which sends an auth token to my APIs whose endpoints are secured but no matter what I do I can’t get an auth token with a payload to send to the APIs even when using Postman to do the PKCE… --- ## [Authorization Code Flow with PKCE - Using express backend 404](https://community.auth0.com/t/authorization-code-flow-with-pkce-using-express-backend-404/78447)
**Author:** [@ibrahimsam96](https://community.auth0.com/u/ibrahimsam96)\ **Replies:** 3\ **Last updated:** [February 18, 2022, 10:28am UTC](https://community.auth0.com/t/authorization-code-flow-with-pkce-using-express-backend-404/78447 "2022-02-18T10:28:02Z")
Express app running on http://localhost:6001 receiving requests from electron application on http://localhost:5000. Authentication process: Authorization Code Flow with PKCE - Authorizing the user(native app) and recei… --- ## [How can I automate the recovery of a code for automated tests?](https://community.auth0.com/t/how-can-i-automate-the-recovery-of-a-code-for-automated-tests/78438)
**Author:** [@salomonjc](https://community.auth0.com/u/salomonjc)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 12:11pm UTC](https://community.auth0.com/t/how-can-i-automate-the-recovery-of-a-code-for-automated-tests/78438 "2022-02-17T12:11:15Z")
Hi, I have been commissioned to automate a website with Auth0 authentication (Authorization Code Flow). I have researched that it uses PKCE and SPA. I was checking that it sends the following variables: auth0Client, co… --- ## [Automation testing and PKCE](https://community.auth0.com/t/automation-testing-and-pkce/64071)
**Author:** [@sazzer](https://community.auth0.com/u/sazzer)\ **Replies:** 4\ **Last updated:** [September 24, 2021, 9:58am UTC](https://community.auth0.com/t/automation-testing-and-pkce/64071 "2021-09-24T09:58:12Z")
I’m currently using the @auth0/auth0-react library to manage login and logout in my app, and it works great. However, I’m now looking to add automation tests to it and I’m looking for a way to fake logging in. I did fin… --- ## [State parameter missing from callback](https://community.auth0.com/t/state-parameter-missing-from-callback/64006)
**Author:** [@tyrone.erasmus](https://community.auth0.com/u/tyrone.erasmus)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 11:50am UTC](https://community.auth0.com/t/state-parameter-missing-from-callback/64006 "2021-06-25T11:50:07Z")
When logging into our site, our users sometimes hit our callback page from Auth0 and don’t get redirected onwards. On closer inspection of why this could be happening, the code looks as follows: if ( window.loca… --- ## [Auth Code + PKCE. Secret VS No Secret?](https://community.auth0.com/t/auth-code-pkce-secret-vs-no-secret/61040)
**Author:** [@VictorioBerra](https://community.auth0.com/u/VictorioBerra)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 11:18am UTC](https://community.auth0.com/t/auth-code-pkce-secret-vs-no-secret/61040 "2021-04-14T11:18:45Z")
Looking for a simple answer to this. SPAs and Clients with a back-end clients can both use Auth Code + PKCE. However, clients with a back-end use secrets (SPAs can’t be trusted to keep one). The official spec for Auth C… --- ## [Auth0 PKCE Postman test automation](https://community.auth0.com/t/auth0-pkce-postman-test-automation/60104)
**Author:** [@eugenio.favalli](https://community.auth0.com/u/eugenio.favalli)\ **Replies:** 3\ **Last updated:** [March 26, 2021, 1:35pm UTC](https://community.auth0.com/t/auth0-pkce-postman-test-automation/60104 "2021-03-26T13:35:09Z")
Hi everyone, I’m trying to automate some APIs tests with postman. APIs are secured by Auth0 and we’re connecting with a mobile app (Authorization code flow + PKCE). I see now postman has the feature to support PKCE, b… --- ## [Using PKCE with auth0-cordova and ionic 5 for refresh tokens](https://community.auth0.com/t/using-pkce-with-auth0-cordova-and-ionic-5-for-refresh-tokens/53726)
**Author:** [@mohammadz](https://community.auth0.com/u/mohammadz)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 7:26pm UTC](https://community.auth0.com/t/using-pkce-with-auth0-cordova-and-ionic-5-for-refresh-tokens/53726 "2020-11-23T19:26:20Z")
Hi, I’m trying to get refresh tokens in my ionic 5 app. So far I have setup my app setup by following the ionic 4 quickstart. This works fine for the login and authentication part. This is a native app created last month… --- ## [Authorization Code Flow with PKCE](https://community.auth0.com/t/authorization-code-flow-with-pkce/50203)
**Author:** [@tma](https://community.auth0.com/u/tma)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 3:52pm UTC](https://community.auth0.com/t/authorization-code-flow-with-pkce/50203 "2020-09-23T15:52:57Z")
I’m using this resource to get my auth flow working: When I send the Auth request, the user is redirected to the login page. Is there a recommended way to store the code\_verifier while the redirect happens? Local stora… --- ## [Where in PKCE flow should you create new users in your own db?](https://community.auth0.com/t/where-in-pkce-flow-should-you-create-new-users-in-your-own-db/44095)
**Author:** [@reinvanimschoot](https://community.auth0.com/u/reinvanimschoot)\ **Replies:** 7\ **Last updated:** [June 8, 2020, 9:04am UTC](https://community.auth0.com/t/where-in-pkce-flow-should-you-create-new-users-in-your-own-db/44095 "2020-06-08T09:04:33Z")
Hi guys I’ve been following this example of a mobile + api flow for PKCE-supported authentication. One thing that seems to be lacking there is the case where you want to create users in your own database based on the r… --- ## [Authorization Code Flow with PKCE using Auth0 Android SDK - Clarification whether the sdk does the pkce implicit?](https://community.auth0.com/t/authorization-code-flow-with-pkce-using-auth0-android-sdk-clarification-whether-the-sdk-does-the-pkce-implicit/40253)
**Author:** [@clma](https://community.auth0.com/u/clma)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 9:36pm UTC](https://community.auth0.com/t/authorization-code-flow-with-pkce-using-auth0-android-sdk-clarification-whether-the-sdk-does-the-pkce-implicit/40253 "2020-04-03T21:36:39Z")
Questions to clarify whether the SDK is already doing the work In our android app I successfully implemented Auth0 for Android using the Quickstart Tutorial. Am I correct that the Authorization Code Flow with PKCE is i… --- ## [Are port wildcards supported? (PKCE for Desktop apps)](https://community.auth0.com/t/are-port-wildcards-supported-pkce-for-desktop-apps/34132)
**Author:** [@ab11](https://community.auth0.com/u/ab11)\ **Replies:** 3\ **Last updated:** [February 21, 2020, 10:56pm UTC](https://community.auth0.com/t/are-port-wildcards-supported-pkce-for-desktop-apps/34132 "2020-02-21T22:56:37Z")
Hi, I came across this post: Loopback Interface Redirection Help. I am in exactly the same situation as the poster, so I will not explain it in detail as I’d be just repeating the same. But to keep it short, I’d like t… --- ## [Loopback Interface Redirection Help](https://community.auth0.com/t/loopback-interface-redirection-help/23014)
**Author:** [@tombowers](https://community.auth0.com/u/tombowers)\ **Replies:** 2\ **Last updated:** [March 25, 2019, 5:40pm UTC](https://community.auth0.com/t/loopback-interface-redirection-help/23014 "2019-03-25T17:40:43Z")
Hi, I’m implementing authentication for a cross-platform desktop app using authorization code grant flow with PKCE. As confirmed by the Auth0 blog post… …it is no longer recommended to use an integrated web browser t… --- ## [I authenticated native application using PKCE, how do I access custom APIs without asking the user to login again?](https://community.auth0.com/t/i-authenticated-native-application-using-pkce-how-do-i-access-custom-apis-without-asking-the-user-to-login-again/19073)
**Author:** [@deepak.sreedharan](https://community.auth0.com/u/deepak.sreedharan)\ **Replies:** 1\ **Last updated:** [December 22, 2018, 6:54pm UTC](https://community.auth0.com/t/i-authenticated-native-application-using-pkce-how-do-i-access-custom-apis-without-asking-the-user-to-login-again/19073 "2018-12-22T18:54:41Z")
Hi! This is likely a newbie question but I’ve done quite a bit of research and have reached a limit on what the documentation can tell me. This post is similar to but not quite the challenge I am having: Question on ha… --- ## [Require a code\_challenge and code\_verifier on auth code with PKCE grant](https://community.auth0.com/t/require-a-code-challenge-and-code-verifier-on-auth-code-with-pkce-grant/18950)
**Author:** [@jlnaps](https://community.auth0.com/u/jlnaps)\ **Replies:** 1\ **Last updated:** [December 12, 2018, 11:50am UTC](https://community.auth0.com/t/require-a-code-challenge-and-code-verifier-on-auth-code-with-pkce-grant/18950 "2018-12-12T11:50:02Z")
In order to support native apps, we are using the auth code flow with PKCE. In testing things though, we’ve found that if an authorization request is made without a code\_challenge and code\_verifier, the request will proc… --- ## [Access\_token using pkce](https://community.auth0.com/t/access-token-using-pkce/9522)
**Author:** [@rakesh\_agrawal](https://community.auth0.com/u/rakesh_agrawal)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 11:35pm UTC](https://community.auth0.com/t/access-token-using-pkce/9522 "2018-02-16T23:35:19Z")
Hi, I am understanding the way to create access\_token using pkce. I found this link: Authorization Code Flow with Proof Key for Code Exchange (PKCE) - Auth0 Docs I notices that the access token which gets generated by… --- ## [Recommended Android Native Authentication and API Access methods clarification](https://community.auth0.com/t/recommended-android-native-authentication-and-api-access-methods-clarification/9467)
**Author:** [@amalycky](https://community.auth0.com/u/amalycky)\ **Replies:** 1\ **Last updated:** [February 12, 2018, 10:57pm UTC](https://community.auth0.com/t/recommended-android-native-authentication-and-api-access-methods-clarification/9467 "2018-02-12T22:57:54Z")
Can I get some clarification on the following I have an Android native client, initially I did a POC with embedded lock for authentication. By the time I got around to wanting to flesh out my logon/token/refresh life cy… --- ## [Is it possible to implement getting Authorization Code using PKCE with custom login form in iOS/Android?](https://community.auth0.com/t/is-it-possible-to-implement-getting-authorization-code-using-pkce-with-custom-login-form-in-ios-android/9402)
**Author:** [@eugenebrusov](https://community.auth0.com/u/eugenebrusov)\ **Replies:** 1\ **Last updated:** [February 8, 2018, 11:20pm UTC](https://community.auth0.com/t/is-it-possible-to-implement-getting-authorization-code-using-pkce-with-custom-login-form-in-ios-android/9402 "2018-02-08T23:20:59Z")
I’ve already implemented getting Authorization Code using PKCE in iOS app, but it requires app to redirect the user to browser and login via Auth0 login form. Just wonder if it’s possible to get Authorization Code using … --- ## [Auth0 PKCE flow additional access tokens](https://community.auth0.com/t/auth0-pkce-flow-additional-access-tokens/9330)
**Author:** [@aec4444](https://community.auth0.com/u/aec4444)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 6:25pm UTC](https://community.auth0.com/t/auth0-pkce-flow-additional-access-tokens/9330 "2018-12-14T18:25:39Z")
Hi I am working on a native app using Auth0Cordova. I have the login flow working using PKCE, redirecting to the hosted page on Auth0, and then having the app get the redirection. I can then access UserInfo and get … --- ## [PKCE flow for Native iOS App : random failures](https://community.auth0.com/t/pkce-flow-for-native-ios-app-random-failures/9216)
**Author:** [@twoolf](https://community.auth0.com/u/twoolf)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 5:53pm UTC](https://community.auth0.com/t/pkce-flow-for-native-ios-app-random-failures/9216 "2018-12-14T17:53:42Z")
We’re continuing to see about 10-50% failure rates in our PKCE native iOS App. We did follow the recent blog post: (Add Authentication To Your iOS Apps with Centralized Login) and don’t see any failures in that sample. … --- ## [PKCE flow and Authorization Extension: Server Errors -- workaround? reinstall?](https://community.auth0.com/t/pkce-flow-and-authorization-extension-server-errors-workaround-reinstall/8733)
**Author:** [@twoolf](https://community.auth0.com/u/twoolf)\ **Replies:** 1\ **Last updated:** [November 14, 2017, 10:46pm UTC](https://community.auth0.com/t/pkce-flow-and-authorization-extension-server-errors-workaround-reinstall/8733 "2017-11-14T22:46:01Z")
Are there any guidelines for how to re-engineer/debug for an “Authorization Extension: An internal server error occurred” (occurs on the initial authorization call for PKCE)? Should we (a) uninstall the Authorization Ex… [Next page](https://community.auth0.com/tag/pkce/365.md?match_all_tags=true&page=1&tags%5B%5D=pkce)