Which OAuth 2.0 flow is recommended for public clients using PKCE?

• A. Authorization Code Flow with PKCE
• B. Client Credentials Flow
• C. Device Code Flow
• D. Implicit Flow

Answer: (A)

PKCE lets public clients prove they are the same client that requested the code without needing a client secret. In this flow, the client creates a random code_verifier and transforms it into a code_challenge that it sends with the authorization request. When exchanging the authorization code for tokens, the client sends the original code_verifier. The authorization server checks that the verifier matches the challenge, tying the code to that client and preventing interception from leaking tokens. This makes the standard authorization code flow safe for apps that can’t securely store secrets, such as mobile apps or single-page apps. So, Authorization Code Flow with PKCE is the recommended path for public clients using PKCE. The other options serve different scenarios: client credentials is for non-user, machine-to-machine access; device code flow targets devices with limited input; and implicit flow is older and less secure, not aligned with PKCE.