---
title: "PKCE defined | Agent Ready Checklist"
description: "PKCE: Proof Key for Code Exchange (RFC 7636): the client sends a hashed code_challenge, then proves it with the code_verifier. Required by MCP authorization."
canonical: https://agentreadychecklist.com/glossary/pkce
site: "Agent Ready Checklist"
last_updated: 2026-11-05
section: "Glossary"
---

# PKCE defined | Agent Ready Checklist

> PKCE: Proof Key for Code Exchange (RFC 7636): the client sends a hashed code_challenge, then proves it with the code_verifier. Required by MCP authorization.

Source: https://agentreadychecklist.com/glossary/pkce
Site: Agent Ready Checklist
Last reviewed: 2026-11-05
Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search)
Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free).

# PKCE

Proof Key for Code Exchange (RFC 7636): the client sends a hashed code\_challenge, then proves it with the code\_verifier. Required by MCP authorization. Example: code\_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code\_challenge\_method=S256. Related rows: AR-ACT-01 (Auth an agent can finish), AR-ACT-03 (MCP over Streamable HTTP). The row "Auth an agent can finish" names PKCE.

## Definition

Proof Key for Code Exchange (RFC 7636): the client sends a hashed code\_challenge, then proves it with the code\_verifier. Required by MCP authorization.

## Example

```text
code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256
```

## Where it appears on the checklist

-   [AR-ACT-01](https://agentreadychecklist.com/checklist/ar-act-01/)Auth an agent can finish: Make authentication completable by an agent: self-serve keys with documented scopes; for user-delegated access, OAuth 2.0 with metadata under /.well-known.
-   [AR-ACT-03](https://agentreadychecklist.com/checklist/ar-act-03/)MCP over Streamable HTTP: Expose an MCP server over Streamable HTTP at /mcp; keep the docs MCP public and gate the product MCP with OAuth and PKCE; list it in the MCP Registry with a server.json.
-   [Guide](https://agentreadychecklist.com/guides/add-oauth-metadata/)How to add OAuth metadata

## Asked about it

### Where should the MCP server live?

The spec says Streamable HTTP at /mcp, docs MCP public, product MCP behind OAuth with protected-resource metadata and PKCE. The Vercel guide calls /mcp a stable choice but not a protocol requirement.

## Sources

-   [rfc-editor.org/rfc/rfc7636](https://www.rfc-editor.org/rfc/rfc7636)read 2026-11-04
-   [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md)read 2026-11-04

Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.