I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like understanding but it always seems to fade.
The nearest I can tell at the moment is that an attacker could have access to server info (via leaking HTTP logs it seems they are saying) but not client info, and thus when you add the code verifier and code challenge you're cutting that out. But then, if you're not acting as a third-party provider atm (and the new guidance seems to include people who aren't) what's the authorization code for and how does that make things better than with Implict Flow?
I'm sure that's ridiculously simplistic. Anything that could help me understand is very welcome :).