PKCE in AUTH V2

import base64, hashlib, secrets

verifier  = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()
challenge = base64.urlsafe_b64encode(
    hashlib.sha256(verifier.encode()).digest()
).rstrip(b"=").decode()

import { randomBytes, createHash } from "node:crypto";

const b64url = (buf) => buf.toString("base64url");

const verifier  = b64url(randomBytes(32));
const challenge = b64url(createHash("sha256").update(verifier).digest());

import CryptoKit
import Foundation
import Security   // SecRandomCopyBytes lives here, not in CryptoKit

func b64url(_ data: Data) -> String {
    data.base64EncodedString()
        .replacingOccurrences(of: "+", with: "-")
        .replacingOccurrences(of: "/", with: "_")
        .replacingOccurrences(of: "=", with: "")
}

var bytes = [UInt8](repeating: 0, count: 32)
// Check the status. On failure `bytes` is still all zeroes, which would give
// you a perfectly valid-looking but entirely predictable verifier.
guard SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes) == errSecSuccess else {
    fatalError("Could not generate a secure code_verifier")
}

let verifier  = b64url(Data(bytes))
let challenge = b64url(Data(SHA256.hash(data: Data(verifier.utf8))))

import android.util.Base64
import java.security.MessageDigest
import java.security.SecureRandom

// NO_WRAP matters: without it the encoder inserts newlines, which are not in
// the verifier alphabet and would be rejected as a malformed code_verifier.
val flags = Base64.URL_SAFE or Base64.NO_PADDING or Base64.NO_WRAP

val bytes = ByteArray(32).also { SecureRandom().nextBytes(it) }
val verifier = Base64.encodeToString(bytes, flags)
val challenge = Base64.encodeToString(
    MessageDigest.getInstance("SHA-256").digest(verifier.toByteArray()), flags
)

import java.security.MessageDigest
import java.security.SecureRandom
import java.util.Base64

// java.util.Base64 rather than android.util.Base64 — outside Android, or on
// Android with minSdk 26+, this is the one you want.
val b64url = Base64.getUrlEncoder().withoutPadding()

val bytes = ByteArray(32).also { SecureRandom().nextBytes(it) }
val verifier = b64url.encodeToString(bytes)
val challenge = b64url.encodeToString(
    MessageDigest.getInstance("SHA-256").digest(verifier.toByteArray())
)