PKCE
Proof Key for Code Exchange: an OAuth extension in which the client sends a hash of a secret when it starts a login and the secret itself when it collects the token, so an intercepted login code is useless to anyone else. OAuth 2.1 and the MCP authorisation specification expect the S256 method.
What PKCE does not show
A server that does not advertise it gives clients no way to know it is supported.
Where PKCE comes up on this site
- 25,983 MCP endpoints from the registry: what they answer, and the eleven whose tools talk to the modelCrawlCheck’s auth audit follows that chain for each locked server: what the default request would be, whether the token is bound to this endpoint or to a whole host, whether PKCE is advertised.
- MCP servers that ask for a login: what 1,366 request firstWhat to do with this Server owners: name the minimum scope in your WWW-Authenticate challenge, publish protected-resource metadata whose resource is exactly your endpoint, advertise PKCE S256, and leave offline_access out of the default.
Terms this definition uses
Related terms in Agents and protocols
How autonomous agents plan, remember, call tools and talk to each other, including MCP and A2A, and where each step can go wrong.
protected-resource metadata · token audience · refresh token · default scope request · tool poisoning · tool lockfile · MCP rug pull · tool shadowing · MCP preflight · agent manifest · stapled verdict · verdict over DNS · agentic web · preflight · decision receipt · receipt header · action assurance · resolve answer · freshness window · AI agent · Agent loop · Planner · Executor · Agent memory · Working memory · Long-term memory · Episodic memory · Semantic memory · Agent orchestration · Multi-agent system · Agent handoff · Delegation · Tool result · Tool schema · Tool description · Tool selection · Tool permission · Human-in-the-loop · Human-on-the-loop · Approval gate · Agent sandbox · Agent identity · Agent authorization · Agent discovery · Capability negotiation · MCP server · MCP client · MCP host · MCP resource · MCP prompt · MCP tool · MCP transport · JSON-RPC · A2A protocol · A2A client · A2A server · Agent skill · Agent task · Agent artifact · WebMCP · A2A
Questions about PKCE
What is PKCE?
Proof Key for Code Exchange: an OAuth extension in which the client sends a hash of a secret when it starts a login and the secret itself when it collects the token, so an intercepted login code is useless to anyone else. OAuth 2.1 and the MCP authorisation specification expect the S256 method.
What does PKCE not show or guarantee?
A server that does not advertise it gives clients no way to know it is supported.
Which area of the glossary does PKCE belong to?
Agents and protocols: How autonomous agents plan, remember, call tools and talk to each other, including MCP and A2A, and where each step can go wrong.
← token audience · refresh token →
See it in the full glossary · 731 terms across 19 areas.