---
type: "Specification"
title: "PKCE — RFC 7636"
description: "Proof Key for Code Exchange; protects auth-code flows from interception."
resource: "https://www.rfc-editor.org/rfc/rfc7636"
tags: [oauth, pkce, security]
generated: { by: human:crpage, at: 2026-07-09T09:44:00Z }
status: stable
sources: [{ id: primary, resource: "https://www.rfc-editor.org/rfc/rfc7636" }]
---

Better current practice for user-present (browser/native) OAuth flows; still usually bearer unless [sender-constrained](../glossary/sender-constrained-token.md). Suitable where a human user is present and consenting.

# Terms
Glossary terms used here: [Bearer token](../glossary/bearer-token.md).