pkce

library1.0.3pypypi✓ verified 22d ago

The `pkce` library is a lightweight Python module designed to simplify the generation of Proof Key for Code Exchange (PKCE) code verifiers and code challenges. It provides essential cryptographic helper functions for implementing the PKCE extension to the OAuth 2.0 Authorization Code Flow, particularly important for public clients (like mobile or single-page applications) that cannot securely store a client secret. The current version is 1.0.3, with an infrequent release cadence reflecting its stable and focused functionality.

auth-security serialization

pip install pkce

github ↗package ↗

INSTALL

IMPORT

SIG · PKCE

pkce

auth-securitypythonv1.0.3

Install

1.5s avg

Import

19ms

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.0.3 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.022s · 17.8MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.5s · import 0.016s · 18MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

pkce

✓ import pkce

Main module import for PKCE utility functions.

This quickstart demonstrates how to generate a PKCE code verifier and its corresponding code challenge using the `pkce` library. You can either generate them as a pair or individually, specifying the desired length for the verifier.

import pkce # Generate a code verifier and code challenge pair code_verifier, code_challenge = pkce.generate_pkce_pair() print(f"Code Verifier: {code_verifier}") print(f"Code Challenge: {code_challenge}") # Alternatively, generate separately single_code_verifier = pkce.generate_code_verifier(length=128) single_code_challenge = pkce.get_code_challenge(single_code_verifier) print(f"\nSingle Code Verifier: {single_code_verifier}") print(f"Single Code Challenge: {single_code_challenge}")

Debug

Known issues

breakingOAuth 2.1 mandates PKCE for all Authorization Code flows, and the 'plain' code challenge method is considered insecure and a downgrade attack vector. Ensure your Authorization Server is configured to require PKCE (S256 method) and that clients always use S256.

fix

Always use the SHA256 (S256) method for code challenge generation. The `pkce` library defaults to S256. Configure your OAuth 2.0 Authorization Server to enforce PKCE for all clients, disallowing the 'plain' method.

affects: All versions (OAuth 2.1 standard as of January 2026)

gotchaWhile the `pkce` library generates the verifier and challenge, proper implementation of the full OAuth 2.0 Authorization Code Flow with PKCE requires careful handling of redirect URIs, state parameters, and secure token storage.

fix

Thoroughly review OAuth 2.0 and PKCE best practices (e.g., RFC 7636, OAuth 2.1 security BCPs). Always validate redirect URIs strictly, use a cryptographically strong 'state' parameter to prevent CSRF, and store tokens securely (avoiding local storage for access tokens in browsers).

affects: All versions

gotchaThe `pkce` library is minimal, focusing solely on code verifier and challenge generation. It does not handle the full OAuth flow (e.g., making HTTP requests to authorization or token endpoints, token storage, or refresh).

fix

Integrate `pkce` with a comprehensive OAuth client library (e.g., `requests-oauthlib`, `Authlib`) or implement the HTTP requests and token management logic yourself, ensuring adherence to security best practices for each step of the OAuth flow.

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'pkce'

The `pkce` Python package has not been installed in the current Python environment.

fix

Install the library using pip: `pip install pkce`

The PKCE code_verifier does not match the stored code challenge.

The `code_verifier` sent during the token exchange request does not match the `code_challenge` originally sent to the authorization server, often due to incorrect generation, storage, or a mismatch in how they are handled between the authorization and token endpoints.

fix

Ensure the exact `code_verifier` generated by `pkce.generate_code_verifier()` is stored securely (e.g., in a session) and used consistently to generate the `code_challenge` (via `pkce.generate_code_challenge()`) and later sent unmodified to the token endpoint.

PKCE code challenge contains illegal characters.

The `code_challenge` was not generated using the correct URL-safe base64 encoding without padding, leading to characters not allowed by the PKCE specification (RFC 7636).

fix

Always use `pkce.generate_code_challenge(code_verifier)` which correctly applies SHA256 hashing and URL-safe base64 encoding without padding, as required by RFC 7636.

Upgrade

Version history

1.0.3latest on PyPI · released Feb 8, 2021

Audit

Dependencies

No dependency data recorded yet.

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/RomeoDespres/pkce ↗

packagehttps://pypi.org/project/pkce/ ↗