{"id":3739,"library":"pkce","title":"PKCE Code Verifier and Challenge Generator","description":"The `pkce` library is a lightweight Python module designed to simplify the generation of Proof Key for Code Exchange (PKCE) code verifiers and code challenges. It provides essential cryptographic helper functions for implementing the PKCE extension to the OAuth 2.0 Authorization Code Flow, particularly important for public clients (like mobile or single-page applications) that cannot securely store a client secret. The current version is 1.0.3, with an infrequent release cadence reflecting its stable and focused functionality.","status":"active","version":"1.0.3","language":"python","source_language":"en","source_url":"https://github.com/RomeoDespres/pkce","tags":["python","pkce","oauth","security","authentication","cryptography"],"install":[{"cmd":"pip install pkce","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"note":"Main module import for PKCE utility functions.","symbol":"pkce","correct":"import pkce"}],"quickstart":{"code":"import pkce\n\n# Generate a code verifier and code challenge pair\ncode_verifier, code_challenge = pkce.generate_pkce_pair()\nprint(f\"Code Verifier: {code_verifier}\")\nprint(f\"Code Challenge: {code_challenge}\")\n\n# Alternatively, generate separately\nsingle_code_verifier = pkce.generate_code_verifier(length=128)\nsingle_code_challenge = pkce.get_code_challenge(single_code_verifier)\nprint(f\"\\nSingle Code Verifier: {single_code_verifier}\")\nprint(f\"Single Code Challenge: {single_code_challenge}\")","lang":"python","description":"This quickstart demonstrates how to generate a PKCE code verifier and its corresponding code challenge using the `pkce` library. You can either generate them as a pair or individually, specifying the desired length for the verifier."},"warnings":[{"fix":"Always use the SHA256 (S256) method for code challenge generation. The `pkce` library defaults to S256. Configure your OAuth 2.0 Authorization Server to enforce PKCE for all clients, disallowing the 'plain' method.","message":"OAuth 2.1 mandates PKCE for all Authorization Code flows, and the 'plain' code challenge method is considered insecure and a downgrade attack vector. Ensure your Authorization Server is configured to require PKCE (S256 method) and that clients always use S256.","severity":"breaking","affected_versions":"All versions (OAuth 2.1 standard as of January 2026)"},{"fix":"Thoroughly review OAuth 2.0 and PKCE best practices (e.g., RFC 7636, OAuth 2.1 security BCPs). Always validate redirect URIs strictly, use a cryptographically strong 'state' parameter to prevent CSRF, and store tokens securely (avoiding local storage for access tokens in browsers).","message":"While the `pkce` library generates the verifier and challenge, proper implementation of the full OAuth 2.0 Authorization Code Flow with PKCE requires careful handling of redirect URIs, state parameters, and secure token storage.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Integrate `pkce` with a comprehensive OAuth client library (e.g., `requests-oauthlib`, `Authlib`) or implement the HTTP requests and token management logic yourself, ensuring adherence to security best practices for each step of the OAuth flow.","message":"The `pkce` library is minimal, focusing solely on code verifier and challenge generation. It does not handle the full OAuth flow (e.g., making HTTP requests to authorization or token endpoints, token storage, or refresh).","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'1.0.3':73 '2.0':46 'applic':61 'authent':89 'author':47 'cadenc':78 'cannot':63 'challeng':5,31 'client':54,67 'code':2,24,27,30,48 'cryptograph':35 'cryptographi':90 'current':70 'design':15 'essenti':34 'exchang':25 'extens':42 'flow':49 'focus':83 'function':37,84 'generat':6,19 'helper':36 'implement':39 'import':51 'infrequ':76 'key':22 'librari':9 'lightweight':12 'like':55 'mobil':56 'modul':14 'oauth':45,87 'page':60 'particular':50 'pkce':1,8,26,41,86 'proof':21 'provid':33 'public':53 'python':13,85 'reflect':79 'releas':77 'secret':68 'secur':64,88 'simplifi':17 'singl':59 'single-pag':58 'stabl':81 'store':65 'verifi':3,28 'version':71","created_at":"2026-04-11T17:42:39.256779+00:00","updated_at":"2026-04-16T18:02:58.510744+00:00","problems":[{"fix":"Install the library using pip: `pip install pkce`","cause":"The `pkce` Python package has not been installed in the current Python environment.","error":"ModuleNotFoundError: No module named 'pkce'"},{"fix":"Ensure the exact `code_verifier` generated by `pkce.generate_code_verifier()` is stored securely (e.g., in a session) and used consistently to generate the `code_challenge` (via `pkce.generate_code_challenge()`) and later sent unmodified to the token endpoint.","cause":"The `code_verifier` sent during the token exchange request does not match the `code_challenge` originally sent to the authorization server, often due to incorrect generation, storage, or a mismatch in how they are handled between the authorization and token endpoints.","error":"The PKCE code_verifier does not match the stored code challenge."},{"fix":"Always use `pkce.generate_code_challenge(code_verifier)` which correctly applies SHA256 hashing and URL-safe base64 encoding without padding, as required by RFC 7636.","cause":"The `code_challenge` was not generated using the correct URL-safe base64 encoding without padding, leading to characters not allowed by the PKCE specification (RFC 7636).","error":"PKCE code challenge contains illegal characters."}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.0.3","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/RomeoDespres/pkce","docs":null,"changelog":null,"pypi":"https://pypi.org/project/pkce/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","serialization"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-08-29","next_check":"2026-07-28","install_tag":null}}