Add PKCE support to SSO get_profile_and_token method

[devin-ai-integration]

Description

Adds PKCE (Proof Key for Code Exchange) support to the SSO module's get_profile_and_token method by introducing an optional code_verifier parameter. This brings the SSO module into alignment with the User Management module, which already supports PKCE flows via authenticate_with_code.

Changes

• Added optional code_verifier parameter to get_profile_and_token in both SSO and AsyncSSO classes
• Updated SSOModule Protocol to include the new parameter
• Added test coverage for PKCE flow in SSO module

Implementation Details

The code_verifier parameter is optional and only included in the API request when provided:

if code_verifier is not None:
    json["code_verifier"] = code_verifier

This is backward-compatible - existing code continues to work without changes.

Testing

• ✅ All existing SSO tests pass (28 tests)
• ✅ New test test_get_profile_and_token_with_code_verifier verifies the parameter is correctly included in the request
• ✅ Type checking passes (mypy)
• ✅ Both sync and async implementations are tested via @pytest.mark.sync_and_async

Human Review Checklist

• Verify the WorkOS /sso/token endpoint accepts code_verifier parameter (most important - I assumed this based on user request)
• Confirm implementation matches the pattern used in user_management.authenticate_with_code
• Check if this requires API reference documentation updates

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes - May need to document the code_verifier parameter for get_profile_and_token

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

---

Link to Devin run: https://app.devin.ai/sessions/0c9b40ba6db24b4db13880d75091292e
Requested by: Deep Singhvi ([email protected]) (@dsinghvi)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring