Glossary · Phase 8 · APIs
PKCE
An OAuth safeguard: the app proves it started the login with a secret only it knows, so a stolen code is useless.
Try it now
The app gets limited access, and it never sees your password.
Learn it properly
Authentication and authorization · API keys, sessions, tokens and OAuth: who's calling, and what may they do? About 45 minutes.
Other terms from the same lesson
- authentication: Proving who is making a request, with a key, a password or a token.
- authorization: Deciding what an authenticated caller is allowed to do.
- JWT: A signed token carrying facts about the caller, such as who they are and when the token expires. Signed, not secret.
- OAuth: The standard way to let an app act for you on another service, without giving it your password.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.