pkce

What it is and what it does

pkce is a lightweight Python module that generates the cryptographic components required for OAuth authorization flows using PKCE (Proof Key for Code Exchange). It provides two main functions: one to generate both a code verifier and its corresponding challenge in a single call, and another to generate a verifier of a specified length and separately compute its challenge. The module has no runtime dependencies and requires Python 3 or later.

The package implements RFC 7636, which defines PKCE as a security extension to the OAuth authorization code flow. It is typically used in mobile apps, single-page applications, and other public clients that cannot securely store a client secret. The module's simplicity makes it suitable for projects that need PKCE support without additional complexity, though its abandoned maintenance status since 2021 means no active development or bug fixes are forthcoming.

Use it for:

• Generate PKCE parameters for mobile app OAuth login flows to prevent authorization code interception attacks.
• Implement secure OAuth authentication in single-page applications without a backend to store secrets.
• Create code verifier and challenge pairs for testing OAuth PKCE compliance in authorization servers.
• Build CLI tools or scripts that interact with OAuth providers requiring PKCE authentication.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates PKCE (Proof Key for Code Exchange) code verifiers and challenges for OAuth authorization flows, implementing RFC 7636.

Yes, if you need straightforward PKCE code generation for OAuth flows and can accept that the package is no longer actively maintained. The underlying PKCE specification is stable, and the module's narrow scope means abandonment poses minimal practical risk. For production use, verify that the implementation matches your provider's PKCE requirements and consider whether you need active maintenance or community support.

Install

pkce on PyPI

pip install pkce

uv add pkce

poetry add pkce

Installing pkce

Before you install

Installation is straightforward with no runtime dependencies. The package is abandoned as of 2021 with no recent maintenance, though the underlying PKCE specification is stable and unlikely to change.

License in practice

MIT license permits commercial and private use with minimal restrictions—suitable for most projects.

Quickstart

pip install pkce

import pkce
code_verifier, code_challenge = pkce.generate_pkce_pair()

# Or separately:
code_verifier = pkce.generate_code_verifier(length=128)
code_challenge = pkce.get_code_challenge(code_verifier)

Verify before relying

• Whether the package correctly implements all PKCE variants as specified in RFC 7636.
• Current compatibility with modern OAuth providers and whether the abandoned status poses practical risk for new integrations.

Package facts

Evidence: pkce-1.0.3-py3-none-any.whl

Tags

More Cryptography packages