The implicit grant flow

The implicit grant flow is used to obtain an access token (or an ID token for OIDC) and is optimized for SPA public clients. Such clients typically run in a web browser, using a client-side scripting language such as JavaScript. This flow does not issue a refresh token, and the interaction between the client and the authorization server is done through the /authorize endpoint only.

The flow is described in the following diagram:

Figure 4.4 – Implicit grant flow

The diagram is explained in detail as follows:

1. An access token is requested by the client application; this is achieved by accessing the /authorize endpoint on the authorization (AuthZ) server. This is what a request looks like:

   GET /authorize?

   response_type=token    (or id_token)

   &client_id=s6BhdRkqt3

   &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb

   &scope=openid%20resource_server_id

   &nonce=n-0S6_WzA2Mj

   &state=af0ifjsldkj...