Skip to content

Conversation

@grudloffev
Copy link
Contributor

Description

This PR introduces full support for the OAuth2 PKCE (Proof Key for Code Exchange) flow to the python-keycloak package.

Highlights

  • PKCE support in code

    • Implements code challenge and verifier handling in the authorization flow.
    • Adds PKCE utilities for code_verifier and code_challenge generation.
    • Updates async and sync methods in KeycloakOpenID to accept PKCE parameters.
    • Adds MIT license header to new modules.
  • PKCE tests

    • Adds tests for PKCE flow.
    • Validates both sync and async PKCE flows.
  • Documentation

    • Updates OpenID client documentation to explain PKCE usage and integration.

Checklist:

  • PKCE support implemented and tested
  • Documentation updated
  • All tests passing

@grudloffev
Copy link
Contributor Author

fixes #635

@grudloffev
Copy link
Contributor Author

hmm I think the failed test was a fluke, seems to be a transient connection issue

@grudloffev
Copy link
Contributor Author

Merged main to trigger retest

@ajepst
Copy link

ajepst commented Nov 21, 2025

Any chance of getting this merged? This is pretty important for full best-practice oauth support.

Copy link
Collaborator

@ryshoooo ryshoooo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot @grudloffev. Overall looks good to me. I've only updated the test to actually perform the PKCE flow as the mocking wasn't really testing anything other than mocking functionality.

@ryshoooo ryshoooo merged commit 6361733 into marcospereirampj:master Dec 27, 2025
34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants