What is PKCE, and why do mobile apps and SPAs need it?

PKCE (Proof Key for Code Exchange) replaces the need for a static client_secret — which can't be safely embedded in a public client like a mobile app or JS bundle without being extractable — with a dynamically generated, per-attempt secret (the code_verifier/code_challenge pair). This ensures that even if an authorization code is intercepted, an attacker cannot complete the token exchange without also knowing the original verifier.