PKCE requirement

Requires a PKCE code challenge at /authorize — for every client, for public clients only, or for a named list.

• Control id: pkce
• Shape: floor. An OR across the own row and every matching binding.
• Entry points: authorize

Policy data

pbac.operator.controls.pkce

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-pkce.v1.json

Setting	Type	Default
require_pkce	boolean	none in the schema
require_pkce_for_public	boolean	none in the schema
require_pkce_for_clients	array of string	none in the schema

Reads

• context.client.client_id
• context.client.client_type
• context.authorize.code_challenge_present

Emits

• deny
• reason

Reason codes

Code	Category	Entry point	Setting
pkce_required	control	authorize	pbac.operator.controls.pkce#require_pkce

Implementation

Kind	Reference	Files	Role
rego_package	oauth.pkce	opa/policies/oauth/pkce.rego	decides