[All skill tests](https://jobicy.com/tests.md) Skill assessment # OAuth 2.0 Authorization Code Flow with PKCE Skills Test Evaluate how well you can implement and troubleshoot OAuth 2.0 authorization code flows that use Proof Key for Code Exchange (PKCE). The test covers request construction, token handling, redirect validation, and security controls. [Start the test](#test-start) Share Assessment setup Ready ## Choose the level that matches your current experience. * 01 Basic Available * 02 Intermediate Available * 03 Advanced Available Instant result Review your score after submission 20–30 Questions per assessment 15–45 min Estimated completion time 3 levels Choose your difficulty Back-End Development & APIs [View category](https://jobicy.com/test-category/back-end-development-apis.md) Start assessment ## Choose your level and begin. Answer without outside help so the result reflects your current knowledge. You will see your score after completing the selected assessment. Back-End Development & APIs includes API design, database access, authentication and authorization, caching, message processing, observability, and deployment integration. This test focuses on OAuth 2.0 authorization code flow with PKCE, a common pattern for connecting applications to identity providers while protecting authorization codes from interception. Sound implementation requires precise handling of redirect URIs, state values, code verifiers, token requests, scopes, and client registration settings. Basic Intermediate Advanced This is a demo version of the test. You may attempt up to 3 questions. To take the full test and save your results, please [log in](https://jobicy.com/dashboard-page.md) or [create an account](https://jobicy.com/dashboard-page#tab2.md). This is a demo version of the test. You may attempt up to 3 questions. To take the full test and save your results, please [log in](https://jobicy.com/dashboard-page.md) or [create an account](https://jobicy.com/dashboard-page#tab2.md). This is a demo version of the test. You may attempt up to 3 questions. To take the full test and save your results, please [log in](https://jobicy.com/dashboard-page.md) or [create an account](https://jobicy.com/dashboard-page#tab2.md). Test details ## Know what to expect. Review the instructions, covered skills, example question themes, and intended audience before beginning. 01 ### Instructions and covered skills Read each scenario carefully before selecting an answer. Keep your attention on the stated OAuth roles, endpoints, and request parameters. Turn off notifications and avoid switching between unrelated tasks while completing the test. Choose the response that best fits the OAuth 2.0 authorization code flow with PKCE. Do not assume that a browser, client application, resource server, and authorization server have identical responsibilities. Review your selections for parameter names and validation requirements before submitting. ### Key Areas This test examines the OAuth 2.0 authorization code flow when it is protected by Proof Key for Code Exchange (PKCE). Candidates should understand the responsibilities of the authorization server, client application, resource server, and resource owner. They should be able to distinguish the browser-facing authorization request from the server-facing token request and identify which values belong in each interaction. Core areas include generating a high-entropy code_verifier, deriving an S256 code_challenge, and retaining the verifier only until the authorization code is exchanged. Candidates should understand why the authorization server stores the challenge with the issued code and compares it during the token request. They should also recognize why plain challenges are less desirable when S256 is available. The assessment covers callback safety controls, including exact redirect URI matching and state correlation. It also addresses scope selection, authorization-code lifetime, one-time code use, token endpoint errors, refresh-token handling, and appropriate use of access tokens at resource servers. Candidates should be able to recognize common implementation faults, such as reusing a verifier, accepting an uncorrelated callback, or sending client credentials from a public client. ### Recommended Preparation Review the OAuth 2.0 authorization code flow from the initial authorization request through token issuance and API access. Practice constructing authorization URLs with response_type=code, client_id, redirect_uri, scope, state, code_challenge, and code_challenge_method=S256. Then practice token requests containing the authorization code, the same redirect URI, client identifier where required, and the original code verifier. Study how URL-safe Base64 encoding without padding is used after SHA-256 hashing the verifier for S256. Review client registration rules for redirect URIs and public versus confidential clients. Finally, use an identity-provider sandbox or API client to inspect authorization redirects, token responses, expiry behavior, and documented error codes without exposing real tokens in logs or source control. 02 ### Examples of questions 1. What value does a client send in the authorization request when using PKCE? 2. Which component validates an authorization code before issuing tokens? 3. Why should a client validate the state value returned in a callback? 4. What is the relationship between code_verifier and code_challenge? 5. Which endpoint receives the authorization code exchange request? 6. What redirect URI rule helps prevent authorization code leakage? 7. When should a client generate a new PKCE code verifier? 8. What does the scope parameter communicate in an authorization request? 9. Which token is commonly presented to a protected API? 10. What should a client do when a token endpoint returns invalid_grant? 03 ### Who this test is best for Back-end developers, API engineers, identity integration developers, and software engineers implementing sign-in or delegated API access. Related assessments ## Continue with a similar skill test. Explore assessments from the same professional area to compare adjacent skills and build a broader picture of your knowledge. [Cybersecurity Fundamentals 3 levelsPhishing Email Analysis and Reporting Skills TestEvaluate the ability to identify phishing indicators, inspect suspicious messages, and select safe reporting actions. The assessment focuses on evidence-based email analysis and… Open assessment →](https://jobicy.com/tests/phishing-email-analysis-and-reporting-skills-test.md) [QA & Software Testing 3 levelsPostman API Test Scripting and Collection Workflow Skills TestThis test evaluates practical use of Postman for validating API behavior, managing request data, and organizing repeatable collection workflows. It focuses on request… Open assessment →](https://jobicy.com/tests/postman-api-test-scripting-and-collection-workflow-skills-test.md) [JavaScript & TypeScript 3 levelsJavaScript Event Delegation and DOM Propagation Skills TestAssess your ability to handle browser events through delegation, bubbling, capturing, and propagation control. The test focuses on reliable event handling patterns for… Open assessment →](https://jobicy.com/tests/javascript-event-delegation-and-dom-propagation-skills-test.md) [Git & Version Control 3 levelsGit Rebase Conflict Resolution and History Recovery Skills TestEvaluate how well you can rebase feature work, resolve conflicts, recover from unwanted history changes, and coordinate rewritten branches. The test focuses on… Open assessment →](https://jobicy.com/tests/git-rebase-conflict-resolution-and-history-recovery-skills-test.md) [Vue.js 3 levelsVue.js Composition API Composables and Dependency Injection Skills TestEvaluate how well you design, consume, and test reusable Vue Composition API logic. The test focuses on composable state, lifecycle handling, dependency injection,… Open assessment →](https://jobicy.com/tests/vue-js-composition-api-composables-and-dependency-injection-skills-test.md) [CSS 3 levelsCSS Cascade Layers and Specificity Resolution Skills TestAssess how CSS declarations compete through origin, importance, cascade layers, specificity, scope proximity, and source order. The test focuses on predicting and controlling… Open assessment →](https://jobicy.com/tests/css-cascade-layers-and-specificity-resolution-skills-test.md) [HTML 3 levelsHTML Semantic Structure and Document Landmarks Skills TestEvaluate how well you select and apply HTML elements that convey meaningful document structure. The test focuses on landmarks, sectioning content, headings, and… Open assessment →](https://jobicy.com/tests/html-semantic-structure-and-document-landmarks-skills-test.md) [Tailwind CSS 3 levelsTailwind CSS Variant Composition and State Styling Skills TestThis test evaluates the use of Tailwind CSS variants to style elements according to interaction, parent state, sibling state, attributes, and structural position.… Open assessment →](https://jobicy.com/tests/tailwind-css-variant-composition-and-state-styling-skills-test.md) [React 3 levelsReact Hooks for State and Side Effects Skills TestEvaluate your proficiency in React Hooks including useState, useEffect, useContext, and more. This test measures your ability to manage state and side effects… Open assessment →](https://jobicy.com/tests/react-hooks-for-state-and-side-effects-skills-test.md) ## Share the assessment or try another skill. Send this test to a colleague or friend, or return to the assessment library to explore another professional area. Share this test [Browse all tests](https://jobicy.com/tests.md)