Description

Adds PKCE (Proof Key for Code Exchange) support to the SSO module's get_profile_and_token method by introducing an optional code_verifier parameter. This brings the SSO module into alignment with the User Management module, which already supports PKCE flows via authenticate_with_code.

Changes

• Added optional code_verifier parameter to get_profile_and_token in both SSO and AsyncSSO classes
• Updated SSOModule Protocol to include the new parameter
• Added test coverage for PKCE flow in SSO module

Implementation Details

The code_verifier parameter is optional and only included in the API request when provided:

if code_verifier is not None:
    json["code_verifier"] = code_verifier

This is backward-compatible - existing code continues to work without changes.

Testing

• ✅ All existing SSO tests pass (28 tests)
• ✅ New test test_get_profile_and_token_with_code_verifier verifies the parameter is correctly included in the request
• ✅ Type checking passes (mypy)
• ✅ Both sync and async implementations are tested via @pytest.mark.sync_and_async

Human Review Checklist

• Verify the WorkOS /sso/token endpoint accepts code_verifier parameter (most important - I assumed this based on user request)
• Confirm implementation matches the pattern used in user_management.authenticate_with_code
• Check if this requires API reference documentation updates

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes - May need to document the code_verifier parameter for get_profile_and_token

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

Link to Devin run: https://app.devin.ai/sessions/0c9b40ba6db24b4db13880d75091292e
Requested by: Deep Singhvi (deep@buildwithfern.com) (@dsinghvi)