Create a transaction secret
01The client creates a fresh, high-entropy verifier for each authorization request.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.1 ↗
RFC 7636 · § 4.1EXAMPLE
3 / 3
03
Keep it local
Do not put the verifier in the authorization request.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 7636 public-client protectionRFC 9700 § 2.1.1
The OAuth security BCP requires PKCE for public clients, recommends it for confidential clients, and requires authorization-server support and downgrade protection.
Read the updated RFC section ↗The verifier is 43–128 unreserved characters.
- The verifier is 43–128 unreserved characters.
- It must be cryptographically random and hard to guess.
- A recommended construction base64url-encodes 32 random octets.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy