# PKCE

October 28, 2025

## PKCE (Proof Key for Code Exchange)

The main feature of this release is PKCE support for 3rd-party OAuth flows of the Hanko API. When using Hanko with a mobile app, the `oauth_state` cookie might not be stored, so the `thirdparty_oauth` action now accepts a `code_verifier`. When the `code_verifier` is set, the state cookie is optional, but the `code_verifier` is required when exchanging the Hanko token with the `exchange_token` action.

[See all updates](/content/changelog/index.html)