[tansan]

PKCE should only be necessary if you're using app linking or have some client app in-between. If you completely trust the server than implicit is fine.

[krooj]

No. This is wrong. Implicit is deprecated in favor of authorization_code + PKCE