# Auth Code with Flow with PKCE not appearing to use the Code Verifier properly

**URL:** <https://devforum.zoom.us/t/auth-code-with-flow-with-pkce-not-appearing-to-use-the-code-verifier-properly/122719>\
**Category:** Authentication\
**Tags:** api\
**Created:** [December 18, 2024, 10:13pm UTC](https://devforum.zoom.us/t/auth-code-with-flow-with-pkce-not-appearing-to-use-the-code-verifier-properly/122719 "2024-12-18T22:13:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicolascoding](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nicolascoding/32/65790_2.png) [@nicolascoding](https://devforum.zoom.us/u/nicolascoding)\
**Post date:** [December 18, 2024, 10:13pm UTC](https://devforum.zoom.us/t/auth-code-with-flow-with-pkce-not-appearing-to-use-the-code-verifier-properly/122719/1 "2024-12-18T22:13:45Z")

</div>

Hi Zoom Team,

We were writing the auth code flow with PKCE using the postman blog (which is great)

and we noticed something that is a bit concerning… when hitting the /oauth/token endpoint, it doesn’t seem to be honoring the code\_verifier when its purposefully incorrect and still issuing the tokens.

Below are some snippits for repro

// PKCE (Proof Key for Code Exchange) utilities  
export function generateCodeVerifier(): string {  
const array = new Uint8Array(32);  
crypto.getRandomValues(array);  
return base64URLEncode(array);  
}

export async function generateCodeChallenge(verifier: string): Promise {  
const encoder = new TextEncoder();  
const data = encoder.encode(verifier);  
const hash = await crypto.subtle.digest(‘SHA-256’, data);  
return base64URLEncode(new Uint8Array(hash));  
}

function base64URLEncode(buffer: Uint8Array): string {  
return btoa(String.fromCharCode(…buffer))  
.replace(/+/g, ‘-’)  
.replace(///g, ‘\_’)  
.replace(/=+$/, ‘’);  
}

// params for call for /authorize  
const params = new URLSearchParams({  
response\_type: ‘code’,  
client\_id: ZOOM\_CONFIG.clientId,  
redirect\_uri: ZOOM\_CONFIG.redirectUri,  
code\_challenge: codeChallenge,  
code\_challenge\_method: ‘S256’,  
// scope: ZOOM\_CONFIG.scope,  
});

// Token call params

const base64Encoded = Buffer.from(  
`${myProcess.env.VITE_ZOOM_CLIENT_ID}:${myProcess.env.VITE_ZOOM_CLIENT_SECRET}`  
).toString(“base64”);  
const tokenResponse = await fetch(“[https://zoom.us/oauth/token](https://zoom.us/oauth/token)”, {  
method: “POST”,  
headers: {  
“Content-Type”: “application/x-www-form-urlencoded”,  
Authorization: `Basic ${base64Encoded}`,  
},  
body: new URLSearchParams({  
grant\_type: “authorization\_code”,  
code,  
redirect\_uri: myProcess.env.VITE\_ZOOM\_REDIRECT\_URI,  
client\_id: myProcess.env.VITE\_ZOOM\_CLIENT\_ID,  
code\_verifier: codeVerifier + “thisshouldnotwork”,  
}),  
});

notice how we append a string “thisshouldnotwork” with the intention of it failing, but it does not.