What is OAuth 2.0 with PKCE in Marketing Cloud, and when is it used for public clients?

PKCE (Proof Key for Code Exchange) is used when a public app (a client that cannot securely store a client_secret — e.g., a single-page app or mobile app) needs to authenticate against Marketing Cloud APIs.
Flow: The app generates a random code_verifier, hashes it to produce code_challenge, then initiates an authorization code flow with code_challenge_method=S256. After the user authenticates, the app receives an authorization code and exchanges it for tokens by sending the original code_verifier — the server validates the hash without ever receiving a client_secret.
In Marketing Cloud Installed Packages, choose Public App component type to enable PKCE. Server-to-Server components use client credentials flow (no PKCE needed). Web App components use standard authorization code flow with a client_secret stored server-side.