Uploaded June 2024 | Updated September 2026, 1 week ago
P-K-C-E, pronounced as “Pixie” stands for Proof Key for Code Exchange, is an extension to the Authorization Code flow to prevent CSRF and authorization code injection attacks for all types of clients.
Pixie has two main steps: the client application creates a secret for each authorization request and then it uses that secret to exchange the authorization code for an access token so if the code is intercepted, it won’t be useful because the token request relies on the dynamically generated secret.
PKCE is recommended for all client types. While it was originally created for mobile apps, it also protects against authorization code injection attacks, which can happen even with a client secret.
P-K-C-E, pronounced as “Pixie” stands for Proof Key for Code Exchange, is an extension to the Authorization Code flow to prevent CSRF and authorization code injection attacks for all types of clients.
Pixie has two main steps: the client application creates a secret for each authorization request and then it uses that secret to exchange the authorization code for an access token so if the code is intercepted, it won’t be useful because the token request relies on the dynamically generated secret.
PKCE is recommended for all client types. While it was originally created for mobile apps, it also protects against authorization code injection attacks, which can happen even with a client secret.
