Account Manager now supports authorization code grant flows with Proof Key for Code Exchange (PKCE) for public API clients. Securely exchange OAuth tokens for client apps that can’t safely store a client secret. PKCE provides a more secure authentication flow for single-page, native mobile, and desktop apps.
Where: This change applies to Account Manager for B2C Commerce.
How: Create an API client and set the client authentication type to public, or convert an existing, private API client. Account Manager then uses PKCE for the access token exchange, replacing the need for a client secret with a code verifier and challenge.