> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Requiring clients to specify S256 when using PKCE for their authorization requests

> Require OAuth 2.0 clients to specify S256 for code_challenge_method parameter when using PKCE for authorization requests with Authlete's feature.

<Note>
  This page is for **Authlete 2.x**. For current (3.0) documentation, see [this page](/configuration-reference/endpoints/requiring-clients-to-specify-s256-when-using-pkce).
</Note>

# Requiring clients to specify "S256" when using PKCE for their authorization requests

Authlete has a feature to require OAuth 2.0 clients to specify a value of "**S256**" for "**code\_challenge\_method**" parameter when using [PKCE (RFC 7636)](/protocols-and-flows/protocol-extensions/proof-key-for-code-exchange-pkce) for their authorization requests.

You can enable this feature by opening "Edit Service" and choosing "Required" at "**S256 for Code Challenge Method**" setting in "Authorization Endpoint" section under "Authorization" tab. The default selection is "Not Required."

<img src="https://mintcdn.com/authlete/KNbgpS77nJg5j2Vw/img/kb/en/oauth-and-openid-connect/pkce-rfc-7636/requiring-s256_1.png?fit=max&auto=format&n=KNbgpS77nJg5j2Vw&q=85&s=a35b85460a5f174a121bf38a0b3150b9" alt="requiring-s256_1" width="906" height="1314" data-path="img/kb/en/oauth-and-openid-connect/pkce-rfc-7636/requiring-s256_1.png" />

*"S256 for Code Challenge Method" setting*

Once enabled, the [/auth/authorization](/api-reference/authorization-endpoint/process-authorization-request) API of the enabled Authlete service denies any authorization requests without "**code\_challenge\_method=S256**." An example is as follows (folded for readability). This authorization request uses PKCE but includes "**code\_challenge\_method=plain**." Thus Authlete denies processing.

**Request**

```text theme={null}
% curl -s -X POST .../auth/authorization
  -u ... -H 'Content-Type: application/json'
  -d '{ "parameters": "redirect_uri=...
    &response_type=code
    &client_id=...
    &scope=...
    &code_challenge=...
    &code_challenge_method=plain" }'
```

**Response**

```json theme={null}
{
  "type": "authorizationResponse",
  "resultCode": "A124308",
  "resultMessage": "[A124308] The value of the 'code_challenge_method' request parameter must be 'S256'.",
  ...
}
```