PKCE protects the auth token from interception by making it so that only your code that started the flow can redeem it by proving they have the secret code_verifier on the redeem_token() call.
The code_challenge == sha256(code_verifier). You will share the code_challenge at the start of the flow.
Yes, that is true, I was assuming that any LLM code was going to be checked by the developer. Step 7 in the guide is "review your code and ensure the important logic commented in the example server is still present".
The LLM is only for converting the JS based example code into your language X and HTTP framework Y (instead of giving example code for every combination of X and Y).
The standard implementation is in a single file `http_server.ts`, which is around 200 lines of well commented code, with important logic commented (around 5 lines). The example code can be run locally with a few commands.
The repo also contains a sequence diagram [1], a description of the HTTP handlers needed [2], and a live demo [3] where you can see the request/responses.
Thanks for your feedback I have made this clearer in the readme.
> Instead you should focus on creating notes that you are likely to revisit or likely to share.
One interesting thing I have discovered: the interface matters just as much as the content.
The faster you can recall notes, the more useful you find them, which makes it more likely you will write more notes.
I also put answers in the titles of my notes which allows me to scan a list of previously solved issues. The combination of a vague yyyy-mm-dd.md title and just a file system UI makes recall harder.
I have a fuzzy search app for Apple Notes that has been working well for me:
The code_challenge == sha256(code_verifier). You will share the code_challenge at the start of the flow.