Does Ory as relying party (not the identity provider) support the authorization code flow with PKCE? Or specifically how do I get Ory to redirecting to

<https://identity-provider.com/oauth/authorization>?
client_id=CLIENT_ID&
redirect_uri=https%3A%2F%2Ffoo.projects.oryapis.com%2Fself-service%2Fmethods%2Foidc%2Fcallback%2FSOME_ID&
response_type=code&
scope=openid+email&
state=STATE&
prompt=select_account&
code_challenge=CODE_CHALLENGE& // <- this is missing
code_challenge_method=S256  // <- this is missing

@narrow-van-43826 maybe?

I've scanned the code base and it seems we don't perform PKCE as the RP anywhere.

Okay thanks that helps. So for now we should disable that check in the identity provider. — Should I file this a feature request in the Ory Network or Ory Kratos repo?

You can do that (in Ory Kratos). Although I don't think it's likely this will be implemented any time soon because the security improvement is pretty minimal. Do you have a usecase where the IdP requires PKCE for OIDC?

We had a use-case where it was by default required and had to disable it

No PKCE for Kratos OIDC yet, unfortunately. PRs welcome :)