---
name: "oauth2-pkce-flow-verifier"
description: "Implement secure OAuth 2.0 authorization code flow with Proof Key for Code Exchange (PKCE)."
metadata:
  author: "IETF OAuth WG"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "implement oauth2 pkce"
  - "generate code challenge sha256"
  - "verify oauth state token"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# OAuth 2.0 PKCE Flow Authorization Verifier

Protects client authorization in single-page apps and mobile apps without client secrets: code_verifier generation, code_challenge SHA-256 calculation, state CSRF verification, and token exchange.

## When to Invoke
Invoke this skill whenever you need to:
- implement oauth2 pkce
- generate code challenge sha256
- verify oauth state token

## Execution SOP & Rules
1. Generate a high-entropy code_verifier between 43 and 128 characters using cryptographically secure random bytes.
2. Calculate code_challenge = base64url(sha256(code_verifier)) with code_challenge_method=S256.
3. Validate state parameter returned from authorization server against stored session state.
4. Store exchanged tokens securely in memory or HttpOnly cookies; never in localStorage.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.