# OAuth PKCE error: invalid_grant — PKCE verification failed / code_verifier does not match code_challenge / code_challenge required

**Code:** `PKCE verification failed` · **Category:** Authentication · **Seen on:** REST API

The code_verifier sent to the token endpoint doesn’t match the code_challenge from the authorize request, or PKCE is required but wasn’t sent.

## Meaning

The verifier must be stored between redirect and callback (sessionStorage/cookie) and hashed with SHA-256, base64url-encoded without padding. Losing it across tabs/redirects, using plain vs S256 inconsistently, or encoding mistakes break PKCE.

## Common causes

- Verifier lost between authorize and callback (new tab, storage cleared)
- Wrong hashing/encoding (base64 instead of base64url, padding)
- Challenge method mismatch (plain vs S256)
- Public client without PKCE where required

## Quick fix

1. Persist the verifier and reuse the exact same string
2. Use a library for PKCE generation
3. Send code_challenge_method=S256

## Detailed fix by platform

### JavaScript

1. 

```javascript
const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
const challenge = base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
sessionStorage.setItem("pkce_verifier", verifier);
```


## How to diagnose

1. **Storage** — Verifier available at callback?
2. **Encoding** — base64url, no padding
3. **Method** — S256 on both sides

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/auth/pkce-code-verifier-invalid)