Go to developer

PKCE

Proof Key for Code Exchange (S256) is required for OAuth Verify. SDKs differ on sync vs async generation — same wire format.

On this page

Why PKCE

Start requests include code_challenge + code_challenge_method: "S256". Token exchange includes the matching code_verifier.

Verifier & challenge

FieldDescription
codeVerifierHigh-entropy secret kept until POST /oauth/token
codeChallengeS256 challenge derived from the verifier; sent at start
codeChallengeMethodAlways "S256" from KEYRA helpers

Sync vs async generatePkce

Server SDK (sync)

SERVERTypeScript
import { createKeyraServer } from "@keyra/typescript-sdk";

const keyra = createKeyraServer({ baseUrl: process.env.KEYRA_BASE_URL! });
const pkce = keyra.generatePkce(); // sync — Node crypto
// pkce.codeChallengeMethod === "S256"

Web SDK (async)

BROWSER / dualTypeScript
import { generatePkce } from "@keyra/web-sdk";

const pkce = await generatePkce(); // async — Web Crypto
// { codeVerifier, codeChallenge, codeChallengeMethod: "S256" }

Auth client

createKeyraAuth uses an internal async generatePkcePair — you do not call it directly. Paste script likewise generates PKCE internally before POST /verify/start.

Where to store the verifier

  • Paste script redirect: session key keyra:oauth:flow:v2
  • Web SDK redirect: sessionStorage key keyra_sdk_transient
  • Server-driven start: store codeVerifier in your server session keyed by state