> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> ### Authlete versions
> Authlete 3.0 is the current version. Unless the user says they use another version, answer for Authlete 3.0 using the 3.x documentation.
> Documentation for Authlete 2.x (pages under `/v2/` and `/ja/v2/`) is for the legacy version. Refer to it only when the user is on Authlete 2.x.
>
> ### Authlete architecture
> Authlete is a backend engine for OAuth 2.0 and OpenID Connect processing. End users and client applications do not call it directly; the service provider's authorization server and API server call Authlete's APIs. Authlete handles protocol processing and token, client, and service management, while the service provider owns the OAuth/OIDC endpoints and user authentication.
> See [Architecture](https://developers.authlete.com/get-started/introduction-to-authlete/architecture.md).
>
> ### Concepts
> If the user is new to Authlete, read these pages first:
> - [Request and Response](https://developers.authlete.com/get-started/concepts/request-and-response.md): Core API requests pass the client's request parameters as-is, and responses return `resultCode`, `action`, and `responseContent`.
> - [Action Handling](https://developers.authlete.com/get-started/concepts/action-handling.md): Branch on `action`, never on `resultCode`, and map each action to the HTTP response your server returns.
> - [Two-Step API Calls](https://developers.authlete.com/get-started/concepts/two-step-api-calls.md): Actions such as `INTERACTION` are completed with a second call (`/auth/authorization/issue` or `/auth/authorization/fail`) linked by a `ticket`.
> - [Management API Overview](https://developers.authlete.com/get-started/concepts/overview.md): The Management API configures services, manages clients, and operates issued tokens, separately from the protocol flows handled by the Core API.
> - [API Authentication](https://developers.authlete.com/get-started/concepts/authentication.md): Authlete APIs use bearer tokens: a Service Access Token (one service) or an Organization Token (the whole organization).

# 認可リクエストにおける PKCE 利用の強制化

> PKCE を利用するよう、クライアントに強制する設定を説明します。

Authlete では、クライアントからの認可リクエストに関し、[**PKCE (RFC 7636)**](/ja/protocols-and-flows/protocol-extensions/proof-key-for-code-exchange-pkce)
の利用を強制できます。

この機能を有効化するためには、サービス編集 → 「認可」タブ → 「認可エンドポイント」セクション にある「**コード交換用証明キー (RFC 7636)**」にて「要求する」を選択します。\
既定値は「要求しない」になっています。

<img src="https://mintcdn.com/authlete/NmFoIJ4VSX_LOgob/img/kb/ja/oauth-and-openid-connect/pkce-rfc-7636/requiring-pkce_1.png?fit=max&auto=format&n=NmFoIJ4VSX_LOgob&q=85&s=40e36d5cbdf87c000678086517a6e122" alt="requiring-pkce_1" width="906" height="1202" data-path="img/kb/ja/oauth-and-openid-connect/pkce-rfc-7636/requiring-pkce_1.png" />

*「コード交換用証明キー (RFC 7636) 」の設定*

「要求する」に設定された Authlete サービスでは、[/auth/authorization API](/api-reference/authorization-endpoint/process-authorization-request)
にて、**code\_challenge** を含まない認可リクエストの処理を拒否します。以下は処理例です（一部折り返しています）。

* リクエスト (code\_challenge を含まない認可リクエストを parameters に指定)

```shell theme={null}
curl -s -X POST .../auth/authorization \
    -u ... \
    -H 'Content-Type: application/json' \
    -d '{"parameters": "redirect_uri=...&response_type=code&client_id=...&scope=..."}'
```

* レスポンス (code\_challenge パラメーターが含まれていない旨を返却)

```json theme={null}
{
    "resultCode": "A124301",
    "resultMessage": 
      "[A124301] The authorization request does not contain
       'code_challenge' parameter. See RFC 7636 for details.",
    ...
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.