PKCE

PKCE (pronounced "pixy") stands for Proof Key for Code Exchange.

It's a small security step in the OAuth login flow.

When a user logs in, the app makes up a secret, sends a scrambled version of it first, then proves it owns the secret when it swaps the login code for a token. If someone steals the code mid-flow, it's useless without that secret.

Why it matters for the ChatGPT funnel

When ChatGPT or Claude connects a buyer to your app, there's a quiet login handshake happening underneath.

PKCE is what keeps that handshake from being hijacked.

If it breaks, the connect step fails, and a buyer who was ready to book just bounces. You don't see the lead. You see nothing.

So it matters the way plumbing matters: invisible when it works, a leak in your funnel when it doesn't. This is one knob in the broader OAuth for MCP flow that authorizes every connection.

How drio fits

You don't have to think about this one.

drio handles PKCE and the rest of the auth handshake for you, so the connection just works and the conversation keeps moving toward a booked meeting.