---
id: w6/m9/t001
title: "Enforce PKCE for all authorization_code clients (Hydra require_pkce)"
worker: worker6
status: done
estimate: 30m
depends_on: []
---

## Objective

Require PKCE for every `authorization_code` client in Hydra, not just rely on public-client behavior, closing the gap `w6/003` identified.

## Context

- `deploy/gitops/base/values/hydra.values.yaml` — Hydra config; `oidc.dynamic_client_registration.enabled: true` already set.
- The real attack surface (public agent DCR clients) is already PKCE-mandated by Hydra per OAuth 2.1 conformance; this closes the gap for a hypothetical future confidential authorization_code client.

## Steps

1. Set Hydra's PKCE-enforcement config in `hydra.values.yaml` (Hydra 2.x supports requiring PKCE for every authorization_code client).
2. If Hydra's own enforcement isn't sufficient, add a check in bex-api or the dashboard consent route (`docs/ADR012-auth.md` §7) rejecting authorization_code clients lacking `require_pkce: true` at DCR time.
3. Verify against the existing agent-connect e2e path (`docs/ADR025-connect-an-agent.md`) that legitimate agent clients still work.

## Files

- `deploy/gitops/base/values/hydra.values.yaml`
- dashboard consent route, if a bex-side check is added

## Acceptance criteria

- [ ] A test authorization_code client without PKCE is rejected.
- [ ] The existing MCP-agent OAuth flow still works end-to-end.

## Out of scope

- client_credentials clients (bootstrap client, API keys) — PKCE doesn't apply.
