title: IdentityServer4 PKCE error: "Transformed code verifier does not match code challenge"
body: <p>I cannot get IdentityServer4 PKCE authorization to work using Postman.</p>
  
  <p>Using online tools I create the necessary parts:</p>
  
  <p>Choose a random string: </p>
  
  <blockquote>
    <p>1234567890</p>
  </blockquote>
  
  <p>Get its SHA-256 hash:</p>
  
  <blockquote>
    <p>c775e7b757ede630cd0aa1113bd102661ab38829ca52a6422ab782862f268646</p>
  </blockquote>
  
  <p>Base64 encode the hash to get the code challenge:     </p>
  
  <blockquote>
    <p>Yzc3NWU3Yjc1N2VkZTYzMGNkMGFhMTExM2JkMTAyNjYxYWIzODgyOWNhNTJhNjQyMmFiNzgyODYyZjI2ODY0Ng==</p>
  </blockquote>
  
  <p>In the browser I navigate to the following URL, fill in my credentials and retrieve the code from the fragmented redirect URL.</p>
  
  <pre><code>GET https://localhost:5000/connect/authorize
  ?client_id=pkceclient
  &amp;scope=openid
  &amp;response_type=code
  &amp;redirect_uri=https://jwt.ms
  &amp;state=abc
  &amp;nonce=xyz  
  &amp;code_challenge=Yzc3NWU3Yjc1N2VkZTYzMGNkMGFhMTExM2JkMTAyNjYxYWIzODgyOWNhNTJhNjQyMmFiNzgyODYyZjI2ODY0Ng==
  &amp;code_challenge_method=S256
  </code></pre>
  
  <p>When redeeming the code for a token I pass the code_verifier (SHA-256 hash) but my IdentityServer logs the following error: </p>
  
  <blockquote>
    <p>"Transformed code verifier does not match code challenge".</p>
  </blockquote>
  
  <pre><code>POST https://localhost:5000/connect/token
  client_id=pkceclient
  grant_type=authorization_code
  code:-CesrmjPYjdLdDd5AviOZpR6GdjjkZia_ZapoJdGUZI
  redirect_uri=https://jwt.ms
  code_verifier=c775e7b757ede630cd0aa1113bd102661ab38829ca52a6422ab782862f268646
  </code></pre>
  
  <p>In his <a href="https://leastprivilege.com/2016/02/02/pkce-support-in-identityserver-and-identitymodel/" rel="noreferrer">blog post</a>, the author uses the following code to generate the parts.</p>
  
  <pre><code>var verifier = CryptoRandom.CreateRandomKeyString(64);
  var challenge = verifier.ToCodeChallenge();
  </code></pre>
  
  <p>but I cannot find the code in the repositories for the <code>ToCodeChallenge</code> method.</p>
  
  <p>Why doesn't my manually generated challenge match the one used in the verification process, what am I missing?</p>