Generate RFC 7636 Proof Key for Code Exchange (PKCE) code_verifier and SHA-256 code_challenge values, build provider Auth URLs, and inspect callback parameters 100% in browser.
{{ authUrl }}Opening or copying this URL starts a session: the Callback Parser tab will check the response against this exact state, redirect_uri, and code_verifier — not whatever is currently in the form above, which may have changed since.
PKCE lets public clients (SPAs, mobile apps) skip a client secret entirely. Some providers — GitHub OAuth Apps among them — still require client_secret at the token endpoint even when PKCE is used, since their OAuth Apps are inherently confidential clients.
{{ curlCommand }}Paste the callback URL or query string returned after login (e.g. https://example.com/callback?code=AUTH_CODE&state=XYZ).
No session yet — open or copy an authorization URL from the builder tab first, so there is a known state, redirect_uri, and code_verifier to check this callback against.
{{ session.codeVerifier }}Do not proceed with this callback. A state mismatch means either this response was not triggered by the authorization URL from this session, or it was forged — exactly what the state parameter exists to catch.
Proof Key for Code Exchange (PKCE, RFC 7636) prevents authorization code injection attacks on single-page web applications (SPAs) and mobile clients. The client creates a secret code_verifier, hashes it into a code_challenge, and proves ownership during token exchange.
Everything runs locally in your browser. Nothing you enter — including the client secret and verifier fields — is transmitted, logged, or stored; it exists only in this page's memory until you navigate away.
