Explainers: OAuth

OAuth PKCE: How the Authorization Code Proof Works

How PKCE binds an OAuth authorization code to one client request, what S256 does and which risks remain.