Authorization Code Flow
The standard OAuth 2.0 flow for server-side applications with a confidential client (RFC 6749 §4.1). The authorization code is exchanged server-to-server, keeping access tokens away from the browser.
Authorization Code Flow
The standard OAuth 2.0 flow for server-side applications with a confidential client (RFC 6749 §4.1). The authorization code is exchanged server-to-server, keeping access tokens away from the browser.
Server-side
Sequence Diagram
Click any step for details
Request
Response
Redirect
Internal
Step-by-Step Breakdown
1
Authorization Request
Client → Authorization Server
2
User Authentication
User → Authorization Server
3
User Consent
User → Authorization Server
4
Authorization Code Response
Authorization Server → Client
5
Token Exchange Request
Client → Authorization Server
6
Token Response
Authorization Server → Client
7
API Request with Token
Client → Resource Server
8
Protected Resource Response
Resource Server → Client
Token Inspector
Specs for this flow
Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.