Okta - PKCE Verification Failed while requesting token

Understand and resolve the "PKCE verification failed" error when integrating with Okta. This guide explains common causes, such as mismatched code verifiers, and provides troubleshooting steps to ensure secure and successful OAuth 2.0 authentication flows.

• "Authorization Code" flow is an OAuth 2.0 flow, wherein an authorization code is issued by the Authorization Server. This code is used for requesting access tokens, used for accessing the protected resources. Authorization code is exchanged through the front-channel and is susceptible to interception attacks.
• PKCE, which stands for "Proof Key for Code Exchange", is a way to protect from interception attacks while trying to fetch tokens using authorization codes.
• In PKCE, the client generates a code verifier and a hashed value of it called code challenge. While requesting the authorization code, a code challenge is sent to the server, which the server persists. While requesting the access token, the client sends a code verifier. The server hashes the verifier and compares it with the challenge. Thus ensuring the request came from the client.

{
    "error": "invalid_grant",
    "error_description": "PKCE verification failed"
}