PlaidEx.OAuth.PKCE (plaid_ex v1.0.0)

PKCE (Proof Key for Code Exchange) implementation for OAuth 2.0.

Plaid's OAuth institutions (e.g., Chase, Wells Fargo) use PKCE to protect the authorization code flow. This module generates the code_verifier and code_challenge pair.

Flow

Generate verifier + challenge: PlaidEx.OAuth.PKCE.generate/0
Store the verifier (server-side): PlaidEx.OAuth.StateStore.put/2
Pass the challenge to Link token creation
After OAuth redirect, retrieve verifier and pass to token exchange

Security

code_verifier: cryptographically random 32-byte string, base64url encoded
code_challenge: SHA-256 hash of verifier, base64url encoded
Challenge method: S256 (required by Plaid)

Summary

Types

t()

Functions

generate()

Generates a new PKCE verifier/challenge pair.

Types

t()

@type t() :: %PlaidEx.OAuth.PKCE{
  challenge_method: String.t(),
  code_challenge: String.t(),
  code_verifier: String.t()
}

Functions

generate()

@spec generate() :: t()

Generates a new PKCE verifier/challenge pair.

Example

pkce = PlaidEx.OAuth.PKCE.generate()
# Store pkce.code_verifier server-side, keyed by state
# Pass pkce.code_challenge to link token creation