Note that PKCE is not supported

[hickford]

Most other OAuth servers support PKCE, so it's worthwhile to note this limitation of GitHub. at https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps

Also because of security implementations https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.7.1

Clients MUST ensure that the AS supports PKCE before using PKCE for CSRF protection. If an authorization server does not support PKCE, state or nonce MUST be used for CSRF protection.

Check off the following:

• I have reviewed my changes in staging (look for the "Automatically generated comment" and click the links in the "Preview" column to view your latest changes).
• For content changes, I have completed the self-review checklist.

[github-actions]

Automatically generated comment ℹ️

This comment is automatically generated and will be overwritten every time changes are committed to this branch.

The table contains an overview of files in the content directory that have been changed in this pull request. It's provided to make it easy to review your changes on the staging site. Please note that changes to the data directory will not show up in this table.

---

Content directory changes

You may find it useful to copy this table into the pull request summary. There you can edit it to share links to important articles or changes and to give a high-level overview of how the changes in your pull request support the overall goals of the pull request.

Source	Preview	Production	What Changed
apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps.md	fpt ghec ghes@ 3.8 3.7 3.6 3.5 3.4 ghae	fpt ghec ghes@ 3.8 3.7 3.6 3.5 3.4 ghae

---

fpt: Free, Pro, Team
ghec: GitHub Enterprise Cloud
ghes: GitHub Enterprise Server
ghae: GitHub AE

[github-actions]

Thanks for opening a pull request! We've triaged this issue for technical review by a subject matter expert 👀

[steveward]

Thanks for the PR @hickford. This was brought up in #22270, and we're still waiting for a technical review there. I'll get this triaged for review as well.

[skedwards88]

@github/ecosystem-apps-reviewers Can you review this PR from a technical perspective?

[nikymorg]

Tagging in @hpsin to review for @github/ecosystem-apps-reviewers. 🙇

[hpsin]

Thanks for including this @hickford ! Looking forward to replacing it with details of how to use these once we are able to add it.

[hickford]

@hpsin thanks. Please could you also review related PR #24964 ?

[skedwards88]

Thanks for this addition @hickford and thanks for the review @hpsin ! We'll get this merged down.

[github-actions]

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡