Implicit Grant (Legacy)

RFC 6749 §4.2 returns an access token in the redirect fragment for a public client. No refresh token is issued. RFC 9700 §2.1.2 says clients SHOULD NOT use this grant; prefer authorization code + PKCE. Kept so the contrast is visible.

Try in Looking Glass

Sequence Diagram

Click any step for details

ClientAuth ServerUser1Authorization Request2User Authentication3Fragment Token Response
Request
Response
Redirect
Internal

Step-by-Step Breakdown

1
Authorization Request
ClientAuthorization Server
2
User Authentication
UserAuthorization Server
3
Fragment Token Response
Authorization ServerClient

Token Inspector

Specs for this flow

Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.

Core specs

· The specifications that define this protocol.

Companion specs

· Extensions, hardenings, and supporting RFCs.