Software Design

OAuth 2.0 PKCE: Securing Public Clients

UML Sequence Diagrams · made in Skemio

Sequence diagram showing OAuth 2.0 PKCE flow between User, SPA Client, Auth Server, and API, exchanging verifier and challenge for tokens.
Sequence diagram showing OAuth 2.0 PKCE flow between User, SPA Client, Auth Server, and API, exchanging verifier and challenge for tokens.
Open it in SkemioMake your own

What it shows

  • Client creates a cryptographic code verifier and SHA-256 challenge.
  • Auth server matches verifier against challenge before issuing tokens.
  • Neutralizes authorization code interception attacks on public devices.

The takeaway

PKCE eliminates static secrets on public clients by dynamically verifying the code requester.

More uml sequence diagrams