The client generates a code_verifier of 43–128 characters from the unreserved URL alphabet, sends code_challenge = BASE64URL(SHA256(code_verifier)) with code_challenge_method=S256 in the authorization request, and later proves possession by sending the verifier to the token endpoint. The plain method sends the verifier itself as the challenge and should not be used.
Designed for mobile apps, where other apps could catch redirect URIs, PKCE also stops authorization code injection in web apps, so RFC 9700 recommends it for every client and the OAuth 2.1 draft requires it. It does not replace client authentication for confidential clients, and the authorization server must reject token requests that omit the verifier when a challenge was sent.