Walk through the OAuth 2.0 authorization code flow with PKCE, and explain when you would use it.

expert Pro

The full answer covers the core mechanics, when this pattern wins, and the trade-offs interviewers most often probe. It includes a code sample. Read it once at your own pace, then try to recall the structure from memory before the interview. Pro also includes this question's interview lens - the likely follow-up probes and what you can say in the room.

Full answer + code samples + AI explanations

Unlock to read the complete answer for this premium question.

Browse free API Design questions → Unlock all · $10/mo

Guided practice for API Design One question at a time. Answer out loud, get graded, see what you missed.

Related concept

Authentication: proving who is calling

Authentication asks who you are and authorization asks what you may do. Authentication methods differ mainly in where the identity state lives.

For this question · chapter 3 of 4

3/4 OAuth delegates without the password

OAuth delegates without the password

Sessions and tokens both work well when you hold the user's account. But a third app can also want the user's files. Then three parties take part: the app, the user, and the provider that holds the user's account.
The wrong way first: the app shows its own login form. The user types the provider password into that form. The app now has a copy of that password. So one breach at the app also breaches the provider account.
This time the app makes a random code_verifier, v9q2, and keeps that verifier. The app sends only the verifier's hash, the code_challenge 3e8f, with the redirect. The user goes to the provider's own page and allows read access to their files. So consent happens at the provider, the same place that stores the password.
The provider issues a one-time code, a1b2, and redirects the browser back to the app with that code. The redirect puts the code in the browser's URL, so the code is visible on the way. The app keeps the code for future requests. A code in a URL can be read from browser history or a log, so the code alone is not worth much.
A copy of code a1b2, taken from the URL, tries the exchange on its own. The copy has no verifier, so the provider refuses the exchange. The request stops at the door, the provider's check. PKCE, proof key for code exchange, makes a stolen code worthless.
The app sends the code a1b2 and the verifier v9q2 to the provider over the back channel. The provider hashes the verifier and gets 3e8f, so the check passes. The provider then returns a token to the app, scoped to files.read only. The password is never sent at any point in this exchange.
The app reads files with that token, and the provider returns 200 (OK). A write with the same token gets 403 instead. The provider refuses the write because the token's scope is files.read and nothing more. Two related flows are worth knowing: client credentials for service-to-service calls, and OIDC as the identity layer.

Chapter 3 · step 1 of 7

Sessions and tokens both work well when you hold the user's account. But a third app can also want the user's files. Then three parties take part: the app, the user, and the provider that holds the user's account.

1 of 7 Use ← → or swipe See the concept: all 4 chapters in it

Want a quick review of the fundamentals? See the API Design cheatsheet.

← Back to all API Design questions

Pro · $10/mo

74 of 92 API Design answers are in Pro.

Full answers, code samples, and AI explanations that go simpler or deeper. Cancel anytime.

Full answers + code
AI explanations, simpler or deeper
1,000 AI credits / month
Cancel anytime

Get Pro → See plans & pricing →