In Salesforce OAuth2.0 Web Server flow, there is an option to not require a client key. But I am not sure whether it supports OAuth 2.0 RFC 7636: https://oauth.net/2/pkce/, which is the PKCE validation. In the document it says:
It requires additional support by the authorization server, so it is only supported on certain providers.
I tried to search through Salesforce documents but didn't find anything related. And I don't see related code base regarding this validation as well. The most similar I have seen so far is this question on Salesforce forum: https://developer.salesforce.com/forums/?id=9060G0000005ag9QAA. But it is also unanswered.
Any thoughts about this one?