Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

html· HTML resultOpen tool

Quick start

Call this tool from your code in three languages.

cURL

curl -X POST 'https://api.elysiatools.com/en/api/tools/pkce-code-verifier-generator' \
  -H 'Content-Type: application/json' \
  -d '{"mode":"generate","byteLength":"64","verifier":"","challenge":"","authEndpoint":"","clientId":"","redirectUri":""}'

API reference

Send a POST request with your inputs as JSON. File parameters require a separate upload first.

Endpoint

HTTP

POST https://api.elysiatools.com/en/api/tools/pkce-code-verifier-generator

Parameters

Name	Type	Required	Description
mode	select	No	—
byteLength	select	No	—
verifier	textarea	No	—
challenge	textarea	No	—
authEndpoint	text	No	—
clientId

MCP integration

Add this tool to your Model Context Protocol server so AI agents can list and call it.

Server configuration

Add this block to your MCP client configuration:

mcp.json

{
  "mcpServers": {
    "elysiatools-pkce-code-verifier-generator": {
      "name": "pkce-code-verifier-generator",
      "description": "Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.",
      "baseUrl": "https://api.elysiatools.com/mcp/sse?toolId=pkce-code-verifier-generator",
      "command": "",
      "args": [],
      "env": {},
      "isActive": true,
      "type": "sse"
    }
  }
}

List available tools

After connecting to the SSE endpoint, list the exposed tools:

tools/list

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}

Call this tool

Invoke the tool by its id, passing arguments built from its parameters:

tools/call

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "pkce-code-verifier-generator",
    "arguments": {
  "mode": "generate",
  "byteLength": "64",
  "verifier": "",
  "challenge": "",
  "authEndpoint": "",
  "clientId": "",
  "redirectUri": ""
}
  }
}

Browse tools Open tool