# Auth Code + PKCE flow supported by Okta mobile SDKs?

**URL:** <https://devforum.okta.com/t/auth-code-pkce-flow-supported-by-okta-mobile-sdks/19483>\
**Category:** Questions\
**Created:** [February 20, 2022, 5:49am UTC](https://devforum.okta.com/t/auth-code-pkce-flow-supported-by-okta-mobile-sdks/19483 "2022-02-20T05:49:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelixp](https://avatars.discourse-cdn.com/v4/letter/m/7993a0/32.png) [@michaelixp](https://devforum.okta.com/u/michaelixp)\
**Post date:** [February 20, 2022, 5:49am UTC](https://devforum.okta.com/t/auth-code-pkce-flow-supported-by-okta-mobile-sdks/19483/1 "2022-02-20T05:49:52Z")

</div>

We’re looking to implement a native mobile application, integrated with Okta login, using a custom embedded login form not re-redirecting to the Okta Hosted Widget.

This guidance outlines that Auth Code + PKCE flow is supported however the methods described here suggests its using a re-direct method to the Okta Hosted Widget: [Implement authorization by grant type | Okta Developer](https://developer.okta.com/docs/guides/implement-grant-type/authcodepkce/main/#next-steps) Is the Auth code + PKCE method supported where an embedded login process is required?

My understanding is that the Okta Swift SDK, for example, outlines this method to authenticate the user: [GitHub - okta/okta-auth-swift: okta-auth-swift](https://github.com/okta/okta-auth-swift#authenticate-a-user), but I cannot find documentation on whether the OIDC /Authorize endpoint is called and that a PKCE code is supplied as well to get an Authorization code? (it’s not evident in the code snippets)

If it is not a Auth Code + PKCE flow, then what type of OIDC flow is used in the Okta Swift SDK? Resource Owner Password Grant? (which does not support PKCE)?

---

<div class="post-metadata">

**Author:** ![abole](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/abole/32/3030_2.png) [@abole](https://devforum.okta.com/u/abole)\
**Post date:** [February 20, 2022, 12:47pm UTC](https://devforum.okta.com/t/auth-code-pkce-flow-supported-by-okta-mobile-sdks/19483/2 "2022-02-20T12:47:10Z")

</div>

I’m also keen to know this (unsurprisingly @michaelixp)

---

<div class="post-metadata">

**Author:** ![brh55](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/brh55/32/3008_2.png) [@brh55](https://devforum.okta.com/u/brh55)\
**Post date:** [February 25, 2022, 1:38am UTC](https://devforum.okta.com/t/auth-code-pkce-flow-supported-by-okta-mobile-sdks/19483/3 "2022-02-25T01:38:36Z")

</div>

From what I understand and see in the codebase, the **okta/okta-auth/swift** is simply a wrapper over primary authentication (AuthN), but does not implement the authorization flow.

What you’ll need to do is create your embedded login with the okta-auth/swift SDK. When users successfully authentication, you’ll receive a sessionToken, which you can provide to manually implement the authorization code flow w/ PKCE or use the [okta/okta-oidc-ios](https://github.com/okta/okta-oidc-ios) with the “.authenticate(withSessionToken)” method to  
[GitHub - okta/okta-oidc-ios: Okta with AppAuth](https://github.com/okta/okta-oidc-ios#authenticate) retrieve a ID/AT/RT.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 9:39pm UTC](https://devforum.okta.com/t/auth-code-pkce-flow-supported-by-okta-mobile-sdks/19483/4 "2024-02-08T21:39:01Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.