Migrate to PKCE

Generate a code verifier and challenge

For each authorization request, generate a fresh PKCE pair:

• code_verifier – a cryptographically random string, 43-128 characters, using only the URL-safe characters A-Z, a-z, 0-9, -, ., _, ~. Keep it secret and store it for the token exchange (Step 3).
• code_challenge – the Base64-URL-encoded (no padding) SHA-256 hash of the code_verifier.

1
import crypto from "crypto";
2
3
function base64UrlEncode(buffer) {
4
  return buffer
5
    .toString("base64")
6
    .replace(/\+/g, "-")
7
    .replace(/\//g, "_")
8
    .replace(/=+$/, "");
9
}
10
11
// 32 random bytes -> 43-character verifier
12
const codeVerifier = base64UrlEncode(crypto.randomBytes(32));
13
14
const codeChallenge = base64UrlEncode(
15
  crypto.createHash("sha256").update(codeVerifier).digest()
16
);
17
18
console.log({ codeVerifier, codeChallenge });

Add the challenge to your authorize request

Append code_challenge and code_challenge_method=S256 to the authorize URL you already build:

https://auth.shipbob.com/connect/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fwww.myapp.com%2Fintegrate%2Fshipbob%2Fcallback
  &response_type=code
  &scope=openid%20offline_access%20channels_read
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256

Add the verifier to your token exchange

Include the matching code_verifier in the token request. The client_secret is still required - PKCE is an additional layer, not a replacement.

$
curl -X POST "https://auth.shipbob.com/connect/token" \
>
  --data-urlencode "grant_type=authorization_code" \
>
  --data-urlencode "client_id=YOUR_CLIENT_ID" \
>
  --data-urlencode "client_secret=YOUR_CLIENT_SECRET" \
>
  --data-urlencode "redirect_uri=https://www.myapp.com/integrate/shipbob/callback" \
>
  --data-urlencode "code=AUTHORIZATION_CODE" \
>
  --data-urlencode "code_verifier=code_verifier_from_step_1"