# `ExMCP.Authorization.PKCE`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/authorization/pkce.ex#L1)

PKCE (Proof Key for Code Exchange) implementation for OAuth 2.1.

PKCE is required for all authorization code flows in OAuth 2.1 to prevent
authorization code interception attacks.

# `generate_code_challenge`

```elixir
@spec generate_code_challenge(String.t()) :: String.t()
```

Generates the code challenge from a code verifier using SHA256.

The code challenge is the base64url encoding of the SHA256 hash of the
code verifier.

## Example

    challenge = PKCE.generate_code_challenge(verifier)
    # => "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

# `generate_code_verifier`

```elixir
@spec generate_code_verifier() :: String.t()
```

Generates a cryptographically secure code verifier.

The code verifier is a high-entropy cryptographic random string using
unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"
with a minimum length of 43 characters and maximum of 128 characters.

## Example

    verifier = PKCE.generate_code_verifier()
    # => "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

# `validate_challenge`

```elixir
@spec validate_challenge(String.t(), String.t()) :: boolean()
```

Validates a code verifier against a code challenge.

This is typically used by the authorization server to verify the PKCE flow.

## Example

    PKCE.validate_challenge(verifier, challenge)
    # => true

# `validate_verifier`

```elixir
@spec validate_verifier(String.t()) :: :ok | {:error, String.t()}
```

Validates that a code verifier meets the RFC 7636 requirements.

Returns `:ok` if valid, or `{:error, reason}` if invalid.

---

*Consult [api-reference.md](api-reference.md) for complete listing*