PKCE should only be necessary if you're using app linking or have some client app in-between. If you completely trust the server than implicit is fine.