OAuth 2.0 and PKCE Guide for Single Page Applications (SPA)
Implement OAuth 2.0 with Proof Key for Code Exchange (PKCE) to protect client-side JavaScript applications from auth code interception.
Enforcing PKCE Flows
PKCE replaces static client secrets with dynamically generated cryptographic code verifiers, protecting authorization authorization code flows in public clients.