OAuth2 Authorization Code + PKCE Flow

This simulator renders the OAuth 2.1 Authorization Code flow with PKCE as a live 3D message-passing diagram between four real actors — the user's browser, the client application, the authorization server, and the protected resource server — computing the actual SHA-256 code_verifier/code_challenge pair with the browser's own WebCrypto API rather than faking it. Step through or auto-play all eight protocol messages, then flip on a stolen-authorization-code attack to see, message by message, exactly why PKCE's proof-of-possession check blocks token theft that would otherwise succeed against a bare Authorization Code flow.