OAuth 2.0 Authorization Code Grant

tools.ietf.org/html/rfc6749#section-1.3.1

The Authorization Code grant type is used by confidential and public clients to exchange an authorization code for an access token.

After the user returns to the client via the redirect URL, the application will get the authorization code from the URL and use it to request an access token.

It is recommended that all clients use the PKCE extension with this flow as well to provide better security.

More resources

• What is the OAuth 2.0 Authorization Code Grant? (developer.okta.com)
• Authorization Code (oauth.com)
• Web Server Apps (aaronparecki.com)
• Authorization Code Grant on the OAuth 2.0 Playground