Olympus Documentation What is Olympus Architecture Repo Map License Glossary

Athena API Authentication Athena API Errors Athena API Pagination Athena Settings API SDK Settings API

Environment variables

OAuth2 grant types Authorization Code Authorization Code + PKCE Client Credentials Refresh Token Implicit Resource Owner Password Credentials

ReferenceGrants

Authorization Code + PKCE

Same as Authorization Code, but with a per-flow `code_verifier` ↔ `code_challenge` pair to prevent code interception.

Authorization Code + PKCE

Spec: RFC 7636

Supported in Olympus: Yes

When to use

Public clients (SPAs, mobile, CLIs). Mandatory in Olympus.

How it works

Same as Authorization Code, but with a per-flow code_verifier ↔ code_challenge pair to prevent code interception.

Integration guide

See /docs/integrate/oauth2/oauth2-pkce for full setup.

Related

Integrate, OAuth2 overview
Security, PKCE enforcement

Authorization Code

User redirects to Hydra → authenticates via Hera/Kratos → returns to app with one-time code → app exchanges code for tokens.

Client Credentials

Confidential client POSTs `grant_type=client_credentials` with its credentials. Hydra returns an access token (no refresh, no ID token).

On this page

Authorization Code + PKCE When to use How it works Integration guide Related