The authorization code flow

OAuth 2.0 Course · lesson 3 of 13 · 6 min read

The main flow, walked message by message - including why the code exists at all.

Open this lesson in the learning hub

Key points

  • The user is redirected to the auth server, logs in, and consents. The client is not involved in that.
  • The auth server redirects back with a short-lived code, not a token.
  • The client then exchanges that code for a token on a back channel - a direct server-to-server call.
  • That two-step exists so the token never travels through the browser URL, where it would be logged and shared.
  • The state parameter is echoed back and must be checked - it is what stops CSRF on the callback.

The code exists so the token never touches the browser URL - that is the entire reason for two steps.

The four roles PKCE: protecting public clients

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.