OAuth 2.0 Authorization Code Flow

Flow at a Glance

1. Client → Auth Server: GET /authorize?response_type=code&client_id=...&state=...&code_challenge=...
2. Auth Server → Client: redirect to /callback?code=...&state=...
3. Client → Auth Server: POST /token { code, code_verifier, redirect_uri }
4. Auth Server → Client: { access_token, refresh_token, expires_in }
5. Client → Resource Server: GET /api with Authorization: Bearer <access_token>

Rule: Always response_type=code. Never response_type=token (implicit flow — deprecated).

PKCE

Required for all public clients (SPAs, mobile). Recommended for server-side too.