Authlete has a feature to require OAuth 2.0 clients to use PKCE (RFC 7636) for their authorization requests.

You can enable this feature by opening "Edit Service" and choosing "Required" at "Proof Key for Code Exchange (RFC 7636)" setting in "Authorization Endpoint" section under "Authorization" tab. The default selection is "Not Required."

Once enabled, /auth/authorization API  of the enabled Authlete service denies any authorization requests without code_challenge parameter. An example is as follows (folded for readability):

• Request (including an authorization request without code_challenge as "parameters")

% curl -s -X POST .../auth/authorization 
  -u ... -H 'Content-Type: application/json' 
  -d '{ "parameters": "redirect_uri=...
    &response_type=code
    &client_id=...
    &scope=..." }'

• Response (stating that code_challenge is missing)

{
  "type": "authorizationResponse",
  "resultCode": "A124301",
  "resultMessage": "[A124301] The authorization request
    does not contain 'code_challenge' parameter. See RFC 7636
    for details.",
...