diff --git a/Auth0/WebAuth/OAuth2Grant.swift b/Auth0/WebAuth/OAuth2Grant.swift
index 817c4e2b..017f50df 100644
--- a/Auth0/WebAuth/OAuth2Grant.swift
+++ b/Auth0/WebAuth/OAuth2Grant.swift
@@ -75,8 +75,17 @@ struct PKCE: OAuth2Grant {
                 let string = String(data: data, encoding: NSUTF8StringEncoding)
                 return callback(.Failure(error: AuthenticationError(string: string)))
             }
+        let clientId = self.clientId
         Authentication(clientId: clientId, url: url)
             .tokenExchange(withCode: code, codeVerifier: verifier, redirectURI: redirectURL.absoluteString)
-            .start(callback)
+            .start { result in
+                // FIXME: Special case for PKCE when the correct method for token endpoint authentication is not set (it should be None)
+                if case .Failure(let cause as AuthenticationError) = result where cause.description == "Unauthorized" {
+                    let error = WebAuthError.PKCENotAllowed("Please go to 'https://manage.auth0.com/#/applications/\(clientId)/settings' and set 'Token Endpoint Authentication Method' to 'None' to enable PKCE.")
+                    callback(Result.Failure(error: error))
+                } else {
+                    callback(result)
+                }
+            }
     }
 }
\ No newline at end of file
diff --git a/Auth0/WebAuth/WebAuthError.swift b/Auth0/WebAuth/WebAuthError.swift
index 79789a21..afb49bae 100644
--- a/Auth0/WebAuth/WebAuthError.swift
+++ b/Auth0/WebAuth/WebAuthError.swift
@@ -28,11 +28,13 @@ import Foundation
  - NoBundleIdentifierFound:        Cannot get the App's Bundle Identifier to use for redirect_uri.
  - CannotDismissWebAuthController: When trying to dismiss WebAuth controller, no presenter controller could be found.
  - UserCancelled:                  User cancelled the web-based authentication, e.g. tapped the "Done" button in SFSafariViewController
+ - PKCENotAllowed:                 PKCE for the supplied Auth0 ClientId was not allowed. You need to set the `Token Endpoint Authentication Method` to `None` in your Auth0 Dashboard
  */
 public enum WebAuthError: ErrorType {
     case NoBundleIdentifierFound
     case CannotDismissWebAuthController
     case UserCancelled
+    case PKCENotAllowed(String)
 }
 
 extension WebAuthError: FoundationErrorConvertible {
@@ -52,6 +54,16 @@ extension WebAuthError: FoundationErrorConvertible {
                 ]
             )
         }
+        if case .PKCENotAllowed(let message) = self {
+            return NSError(
+                domain: WebAuthError.FoundationDomain,
+                code: WebAuthError.GenericFoundationCode,
+                userInfo: [
+                    NSLocalizedDescriptionKey: message,
+                    WebAuthError.FoundationUserInfoKey: self as NSError
+                ]
+            )
+        }
         return NSError(
             domain: WebAuthError.FoundationDomain,
             code: WebAuthError.GenericFoundationCode,