Settings and activity

1 result found

1. Add PKCE Support to the OAuth2.0 Authorization Code Flow

   63 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   9 comments  ·  Developers » API  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating
   Planned  ·  AdminMarc Szanto (Admin, Twitch) responded

   At TwitchCon EU 2026, we announced that PKCE will be available later this year.

   GenideGaming supported this idea  ·  Feb 5, 2022
   An error occurred while saving the comment
   GenideGaming commented  ·  May 30, 2021  ·  Edit…  ·  Delete…

   Someone please implement this soon!

   IEFT best practices REQUIRES PKCE for public clients (e.g. Standalone Applications) and is RECOMMENDED for confidential clients (e.g. Web Server). Twitch should transition away from implicit authorization to PKCE Authorization code flow.
   https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1

   Re-posting links here because the original one leads to 404.
   https://oauth.net/2/pkce/
   https://datatracker.ietf.org/doc/html/rfc7636

   Save Submitting...