diff --git a/src/services/auth-oidc/auth-oidc.class.ts b/src/services/auth-oidc/auth-oidc.class.ts
index 2f96233..29283be 100644
--- a/src/services/auth-oidc/auth-oidc.class.ts
+++ b/src/services/auth-oidc/auth-oidc.class.ts
@@ -33,12 +33,18 @@ export class AuthOidcService<ServiceParams extends AuthOidcParams = AuthOidcPara
             id_token_signed_response_alg: config.get('oidc.signedResponseAlg'),
             token_endpoint_auth_method: config.get('oidc.authMethod'),
         });
+        const codeVerifier = generators.codeVerifier();
+        const codeChallenge = generators.codeChallenge(codeVerifier);
+
         const url = client.authorizationUrl({
             redirect_uri: config.get('clientUrl') + '/auth-oidc/callback',
             scope: config.get('oidc.scopes'),
             response_type: config.get('oidc.responseTypes'),
+            code_challenge: codeChallenge,
+            code_challenge_method: config.get('oidc.codeChallengeMethod'),
         });
 
+        params.session.codeVerifier = codeVerifier;
         return url;
     }
 }
diff --git a/src/services/auth-oidc/callback/auth-oidc-callback.class.ts b/src/services/auth-oidc/callback/auth-oidc-callback.class.ts
index e388762..c4c9234 100644
--- a/src/services/auth-oidc/callback/auth-oidc-callback.class.ts
+++ b/src/services/auth-oidc/callback/auth-oidc-callback.class.ts
@@ -37,9 +37,11 @@ export class AuthOidcCallbackService<ServiceParams extends AuthOidcCallbackParam
             response_types: ['code'],
         });
 
+        const codeVerifier = params.session.codeVerifier;
         const tokenSet = await client.callback(
             config.get('clientUrl') + '/auth-oidc/callback',
             { code: params.query.code, iss: params.query.iss },
+            { code_verifier: codeVerifier }
         );
         const userinfo = await client.userinfo(tokenSet.access_token as string);