OAuth code flow with PKCE

  • Order
  • Lock 03

Difficulty 2 of 5

Order one successful authorization-code exchange with PKCE over TLS. The client uses S256, a fresh verifier, and a fresh state value. The redirect URI is registered. Every check succeeds.

Play level

Put these steps in order

  • Check that the returned state matches the pending client request
  • Send the code, verifier, client ID, and matching redirect URI to the token endpoint
  • Validate all code bindings and the S256 verifier; consume the code
  • Issue tokens; use the access token only for its allowed resource and scope
  • Create fresh state and verifier; derive the S256 challenge
  • Send the browser authorization request with state, challenge, and registered redirect URI
  • Authenticate the user, obtain consent, and redirect with a bound one-use code and state
A wait for a person needs its own queueTap or press Space to turn the approval queue on or off

Goals and limits

p99 latency
under 200 ms
Monthly cost
under 10 USD/mo
Traffic
100 req/s

Concepts

How players did

Player results load from the server.

All levels