To set up OAuth2 PKCE for a mobile app, follow these steps:

1. Generate a cryptographically random code_verifier (43-128 characters) [1]
2. Compute the code_challenge using SHA256: base64url(sha256(verifier)) [1]
3. Include code_challenge and code_challenge_method=S256 in the authorization request [2]
4. Store the verifier securely (Keychain on iOS, EncryptedSharedPrefs on Android) [3]
5. Send the original verifier during the token exchange [2]

This is now mandatory for all public clients per the OAuth 2.1 draft specification.

For React Native, the recommended library is react-native-app-auth [3]. It:

• Supports PKCE out of the box
• Handles both iOS and Android securely
• Uses the system browser (not WebView) per best practices
• Supports refresh token rotation

Install with: npm install react-native-app-auth