The authorization code grant flow

The authorization code grant flow is used by a client application to obtain both an access token (or an ID token for OIDC) and a refresh token, and it is even more secure when used with confidential clients. Because this is a redirection-based flow, the client must be able to connect with the resource owner’s user agent (usually a web browser) and receive inbound requests from the authorization server (via redirection).

The flow is described in the following diagram:

Figure 4.2 – Authorization code grant flow

The diagram is explained in detail in the following list. Each item reports the specific interaction that occurs at the numbered point in the diagram:

1. The client application requests an authorization code (authorization grant proof) from the /authorize endpoint of the authorization (AuthZ) server. This is what a request looks like:

   GET /authorize?

   response_type=code

   &client_id=s6BhdRkqt3

   &redirect_uri...