Override the Code Challenge Method for OAuth Button in Settings API

[brh55]

I'm trying to implement the OAuth settings component using the Authorization Code Flow w/ PKCE with my OAuth provider. It almost works, except that the `code_challenge_method` parameter is set to "plain", which isn't supported in a few identity services like Auth0 or Okta.

Is there any support on this or should I resort to using the client credentials flow (client id and secret). If I do with the client credentials flow, is it safe to assume that the client secret can be safely hard-coded without being exposed?

Help is much appreciated, thank you!

[JohnFitbit]

Hi @brh55,

If your client supports it, I recommend that your code_challenge_method be hashed with SHA256. While "plain" is supported, it's not actually recommended as it does not mitigate as wide a range of attacks as SHA256. You can check the RFC documentation here.

I hope this helps. Let me know if you have additional questions.

[brh55]

Sorry @JohnFitbit !

I thought I had posted this on the SDK Development forum . This question is more-so around the OAuth Settings component for developing Fitbit devices applications.

[JohnFitbit]

@brh55 No worries, though if it helps clarify further, we actually cover this topic in our Web API documentation at https://dev.fitbit.com/build/reference/web-api/oauth2/#authorization-code-grant-flow-with-pkce too.