OAuth oauth.net

Authorization Code

RFC 6749 §1.3.1 Published tools.ietf.org/html/rfc6749

The Authorization Code flow is the most widely used OAuth 2.0 grant type. The user is redirected to the authorization server to grant permission, and the client receives an authorization code it exchanges for an access token.

When to use this Use the Authorization Code flow whenever a user needs to grant your app access to their account or data. This covers web apps, single-page apps, and native/mobile apps. Always combine it with PKCE — even for confidential clients.

The flow works in two steps. First, the user is sent to the authorization server where they log in and approve the requested permissions. The authorization server redirects back to your app with a short-lived authorization code in the URL. Second, your app exchanges that code — along with its client credentials — for an access token at the token endpoint. Because the access token never touches the browser, it is not exposed to the user or to JavaScript.

All clients should use the PKCE extension with this flow to prevent authorization code injection attacks. Public clients (SPAs and mobile apps) use PKCE in place of a client secret; confidential clients use PKCE in addition to their client secret.

More resources