Proof Key for Code Exchange (PKCE, RFC 7636) secures the Authorization Code flow for public clients (SPAs, Mobile Apps) against authorization code interception attacks.

PKCE Protocol Steps:

1. Client creates a random string code_verifier and computes code_challenge = BASE64URL(SHA256(code_verifier)).
2. Client redirects user to Authorization Server passing code_challenge and code_challenge_method=S256.
3. User authenticates and grants access; Authorization Server redirects back with an authorization_code.
4. Client exchanges authorization_code + original code_verifier at the token endpoint.
5. Authorization Server hashes the provided code_verifier and verifies it matches the stored code_challenge before returning access tokens.