OAuth 2.0 PKCE & Authorization URL Generator

Generate cryptographic code_verifier, SHA-256 code_challenge, and build complete OAuth 2.0 PKCE authorization URLs.

Provider:

Cryptographic PKCE Parameters (RFC 7636)

code_verifier (Stored in client session):

code_challenge (SHA-256 Base64URL):

OAuth Client Configuration

Client ID:

Redirect URI (Callback):

Scopes (Space separated):

Generated Authorization URL

https://accounts.google.com/o/oauth2/v2/auth?client_id=your-client-id.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback&response_type=code&scope=openid+profile+email&state=&code_challenge=&code_challenge_method=S256

Token Exchange POST Request (cURL)

curl -X POST https://oauth2.googleapis.com/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=your-client-id.apps.googleusercontent.com" \
  -d "code=AUTHORIZATION_CODE_FROM_CALLBACK" \
  -d "redirect_uri=http://localhost:3000/api/auth/callback" \
  -d "code_verifier="

Why PKCE is Mandatory for Public Clients

In traditional OAuth 2.0 Authorization Code flow, a confidential client_secret is required to exchange the authorization code for an access token. Single Page Applications (SPAs) and mobile apps cannot safely hold a client secret without exposing it to decompilation or browser inspection. Proof Key for Code Exchange (PKCE - RFC 7636) eliminates the need for client secrets on public clients.

The PKCE Handshake Steps

Create Verifier: The client creates a cryptographically random string (code_verifier).
Create Challenge: The client hashes the verifier using SHA-256 and base64url encodes it to produce the code_challenge.
Authorization Request: The client sends the code_challenge and code_challenge_method=S256 to the authorization server.
Token Exchange: Upon receiving the authorization code callback, the client sends the original unhashed code_verifier in the POST token exchange request. The auth server computes SHA-256(code_verifier) and verifies it matches the original challenge before issuing the token.