A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inertBy RepublisherSeptember 2, 2026 Keycloak 26.7.1, in a realm where every hand-authored client carries “pkce.code.challenge.method”: “S256” and refuses plain. Enable the OAuth Client ID…
