The code remembers its challenge
03The authorization server associates the challenge and method with the code it issues.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.4 ↗
RFC 7636 · § 4.4EXAMPLE
3 / 3
03
Token request
Present the code together with the original verifier.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
The challenge is not an access token.
- The challenge is not an access token.
- The code is bound to the request’s challenge and method.
- The client later sends the verifier to the token endpoint.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy