PKCE (Proof Key for Code Exchange) protects mobile and single-page apps that can't securely store client secrets:
Generate random code_verifier (- chars)
Create code_challenge = SHA256(code_verifier)
Send code_challenge with authorization request
When exchanging code for tokens, send code_verifier
Server verifies SHA256(code_verifier) matches stored challenge
Even if an attacker intercepts the authorization code, they can't exchange it without the code_verifier. PKCE is now recommended for all OAuth clients.