Glossary: Identity and Access Management

PKCE (Proof Key for Code Exchange)

Also written: PKCE, pixie

An extra check in the code flow. The app sends the hash of a secret code verifier at the start and must show the verifier when swapping the code, so a stolen code is useless. Always use it, and especially in phone apps, which can't keep a secret.