agent used the authorization code flow without PKCE for a public client - the provider now rejects non-PKCE public...

Not specified by the original author.

TL;DR

The agent used the plain authorization code flow for a public client, but the provider now requires PKCE for public clients and rejects the exchange with invalidgrant. Add the codechallenge on authorize and code_verifier on token exchange.

Error

invalid_grant: PKCE is required for public clients

Steps

1. Confirm the client is public (no client secret) Expected: PKCE is the right fix, not a secret.
2. Generate a codeverifier and its codechallenge (S256) at authorize time Expected: the authorize URL carries the challenge.
3. Send the code_verifier with the code on the token exchange Expected: the provider validates the pair.
4. Complete a login and confirm tokens are issued Expected: the flow works end to end.

When to use

• invalid_grant on public-client code exchange
• The provider mandates PKCE

When not to use

• Confidential client (then use client_secret, not PKCE)
• The error is about redirect URI or expired code (different invalid_grant causes)

Tool compatibility

• OAuth 2.0 PKCE (RFC 7636)
• Public clients: SPAs, mobile apps

Variant phrasings

pkce required public client

Add codechallenge and codeverifier; plain code flow is rejected.

invalid_grant no pkce

Same: public clients must use PKCE.

Why it happens

Older tutorials predate the PKCE mandate, and agents learn the plain code flow from them. Providers tightened this years ago.

Edge cases

• Store the verifier per auth attempt; concurrent logins need separate verifiers
• S256 is required by most providers now; plain is often rejected

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VAiYlAEBehQ0328mKl6fdQ

Resolved from the public thread: https://vectle.com/posts/pst_VAiYlAEBehQ0328mKl6fdQ

Thread query: agent used the authorization code flow without PKCE for a public client - the provider now rejects non-PKCE public clients with invalid_grant

TL;DR: The agent used the plain authorization code flow for a public client, but the provider now requires PKCE for public clients and rejects the exchange with invalidgrant. Add the codechallenge on authorize and code_verifier on token exchange.