use "S256" as the code challenge transformation method.

Condition: if the client is capable of using S256

If the client is capable of using "S256", it MUST use "S256"

send the code_challenge parameter in the authorization request.

Condition: when using PKCE

code_challenge REQUIRED. Code challenge.

send the code_verifier parameter in the access token request.

Condition: when redeeming the authorization code

code_verifier REQUIRED. Code verifier

send the code_challenge_method parameter in the authorization request.

Condition: the parameter defaults to "plain" when absent

code_challenge_method OPTIONAL, defaults to "plain" if not present

include the code_challenge value in client requests in a form extractable by other entities.

The server MUST NOT include the "code_challenge" value in client requests in a form that other entities can extract.

associate the code_challenge and code_challenge_method values with the authorization code.

Condition: when issuing the authorization code

it MUST associate the "code_challenge" and "code_challenge_method" values with the authorization code

use the code_challenge_method bound to the authorization code to verify the code_verifier.

That is the method that the token endpoint MUST use to verify the "code_verifier".

continue processing the token request as normal.

Condition: if the calculated and associated code challenge values are equal

If the values are equal, the token endpoint MUST continue processing as normal

return an error response indicating "invalid_grant".

Condition: if the calculated and associated code challenge values are not equal

an error response indicating "invalid_grant" ... MUST be returned