A stolen code fails the proof
04The token endpoint recomputes the challenge and compares it with the one bound to the code.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.6 ↗
RFC 7636 · § 4.6EXAMPLE
3 / 3
03
Reject
The server returns invalid_grant and issues no token for the failed exchange.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A mismatched verifier produces invalid_grant.
- A mismatched verifier produces invalid_grant.
- A code alone does not satisfy PKCE.
- Other authorization-code validation rules still apply.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy