Should Supabase make PKCE optional for confidential clients in the OAuth server?

I am currently setting up Shopify as a confidential OAuth client for Supabase. After getting everything configured and connected, I found out that Shopify does not supply a code_challenge or code_challenge_method in the /auth/v1/oauth/authorize endpoint. Here is a snippet from [RFC 9700 section 2.1.1]( > - Public clients MUST use PKCE [[RFC7636]( to this end, as motivated in [Section 4.5.3.1]( > - For confidential clients, the use of PKCE [[RFC7636]( is RECOMMENDED, as it provides strong protection against misuse and injection of authorization codes as described in [Section 4.5.3.1]( Also, as a side effect, it prevents CSRF even in the presence of strong attackers as described in [Section 4.7.1]( > - With additional precautions, described in [Section 4.5.3.2]( confidential OpenID Connect [[OpenID.Core]( clients MAY use the nonce parameter and the respective Claim in the ID Token instead. The last point is what is most important. Because the nonce parameter can be …