Choosing a grant type

OAuth 2.0 Course · lesson 5 of 13 · 5 min read

Four grants remain relevant, and two you should never use again.

Open this lesson in the learning hub

Key points

  • Authorization code + PKCE: the default for anything with a user. Web, SPA, mobile.
  • Client credentials: no user at all - one service calling another with its own identity.
  • Device code: for TVs and CLIs, where typing a password is impractical.
  • Refresh token: not a login flow; it renews an access token without involving the user.
  • Implicit and password grants are deprecated - implicit put tokens in the URL, password made the client handle credentials.

Pick by two questions: is a human involved, and can the client keep a secret.

PKCE: protecting public clients Scopes and consent

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.