Here’s a description of all the major flows of OAuth 2.0, along with a visual description of PKCE (and the attack it prevents)
https://youtu.be/tpIXmmV4ib4