Glossary: Web App Security and Authentication

Code verifier

Also written: code challenge, code_challenge_method S256, S256

In PKCE, the verifier is a random value kept by kc-shop. The challenge is its SHA-256 hash, sent first, and the verifier is revealed only when swapping the code for tokens.