Implicit Flow

The Implicit flow was designed for browser-based apps and returned the access token directly in the URL fragment — skipping the authorization code exchange step. It is now deprecated and should not be used in new applications.

The Implicit flow was designed when CORS was not widely available and developers needed a way to get tokens entirely in the browser. By returning the access token directly in the URL hash (#access_token=...), it skipped the server-side token exchange. This introduced several problems: tokens in URL fragments are exposed to the browser history, referrer headers, and any JavaScript on the page. There is also no way to authenticate the client or verify that the token was delivered to the intended recipient.

PKCE solves the original problem the Implicit flow was designed for — protecting public clients — without any of those risks. All modern browsers support the CORS requests needed for the Authorization Code token exchange, making the Implicit flow unnecessary.

Migration: what to use instead

• SPA / browser app: Authorization Code + PKCE — see Browser-Based Apps guidance
• Mobile / native app: Authorization Code + PKCE — see Native Apps guidance

More resources

• What's Going On with the Implicit Flow? — video by Aaron Parecki
• Is the OAuth 2.0 Implicit Flow Dead? (developer.okta.com)
• Why you should stop using the OAuth implicit grant (Torsten Lodderstedt)
• Implicit Grant on the OAuth 2.0 Playground