OAuth 2.0 extension preventing authorization code interception attacks. Required for public clients like mobile apps and SPAs that can't securely store secrets.