When doing Authorization Code Flow, Client Credentials Flow, or Resource Owner Password Flow, Okta returns the following error on the /token endpoint of the authorization server:

{
    "error": "invalid_client",
    "error_description": "Browser requests to the token endpoint must use Proof Key for Code Exchange."
}

• OpenID Connect
• OAuth 2.0
• Authorization Code Flow
• Client Credentials Flow
• Resource Owner Password Flow
• Okta Classic Engine

The "Origin" header is present in the request to the /token endpoint of the authorization server.

The "Origin" header is used for client-side requests, and Okta requires PKCE if the /token request is made on the client side.

Authorization Code Flow with PKCE is the only client-side OIDC flow that can use the /token endpoint of the authorization server. Any other OIDC flows must send the request through a server-side/native method and must not have the "Origin" header present in the /token request.

NOTE: The browser version of the Postman application may automatically add the "Origin" header to the payload. If using this version, double-check to see if the Origin header has been added to the /token call.