What is the 'authorization code PKCE flow' complete step-by-step for a Single Page Application?

• A.SPA exchanges the code using client_secret; the code_verifier replaces the secret in PKCE; device authorization flow (device code) requires a browser on the constrained device itself, which is why TVs embed one; WebAuthn credentials are portable text secrets, and a phished user can be tricked into typing one into a fake site; MFA fatigue attacks are prevented by plain push notifications, which is why number-matching prompts were withdrawn; session-based auth cannot support logout, which is the main argument for stateless JWTs in browser apps
• B.PKCE flow for SPAs is identical to client credentials flow with additional CSRF protection
• C.1. SPA generates code_verifier (random 32-96 bytes) and code_challenge = base64url(sha256(verifier)). 2. Redirect to IdP: /authorize?client_id=...&code_challenge=...&code_challenge_method=S256&state=csrf&redirect_uri=... 3. User authenticates at IdP. 4. IdP redirects back to SPA: /callback?code=abc&state=csrf. 5. SPA validates state matches. 6. SPA exchanges: POST /token {code=abc, code_verifier=..., client_id=...}. 7. IdP verifies sha256(verifier)==challenge, returns access+ID+refresh tokens