Hello
I think I have discovered a mistake in the PKCE documentation.
There, it says that the app has to redirect to
https://login.mypurecloud.com/oauth/authorize?
client_id=<my-client-id>&
response_type=code&
redirect_uri=<http://example.com/oauth/callback>&
code_challenge=xxxx
However, I've tried it and it causes an invalid_request error. I think it is because the code_challenge_method parameter is missing, because if I instead use
https://login.mypurecloud.com/oauth/authorize?
client_id=<my-client-id>&
response_type=code&
redirect_uri=<http://example.com/oauth/callback>&
code_challenge=xxxx&
code_challenge_method=S256
it works fine.
As the RFC says, not including code_challenge_method implies it uses the default, plain, whereas it is using SHA256.
Could you check it, please? Thank you!