Proof Key for Code Exchange is Required for Cross-Origin Authorization Code Redemption Error

This article explains the access_denied error with the description, "Proof Key for Code Exchange is required for cross-origin authorization code redemption.

{
  "error": "access_denied",
  "error_description": "Proof Key for Code Exchange is required for cross-origin authorization code redemption."
}

• Social Connections
• Single-Page Applications (SPA)
• Authorization Code Flow with Proof Key for Code Exchange (PKCE)

Redirect URI configured on the Azure side was set using the Single Page Application setting.

Auth0 uses the standard Authorization Code flow with Azure for these social connections, so these redirect URIs need to be set up as Web redirect URIs, and not under Single Page Applications.

To resolve this issue, the Auth0 callback URL must be registered as a Web redirect URI in the Microsoft Azure portal.

1. Sign in to the Microsoft Azure portal.

2. Navigate to Azure Active Directory and select App registrations.

3. Choose the application that is used for the Auth0 Social Connection.

4. From the sidebar, select Authentication.

5. Select Add a platform and choose the Web platform.
    

6. In the Redirect URIs field, enter the tenant's callback URL: https://<AUTH0_DOMAIN>/login/callback. 

7. Select Configure to save the changes.

This configuration ensures that Microsoft Azure treats Auth0 as a web application, allowing the standard Authorization Code Flow to complete successfully without enforcing the PKCE requirement.