Implicit Grant (Legacy)
RFC 6749 §4.2 returns an access token in the redirect fragment for a public client. No refresh token is issued. RFC 9700 §2.1.2 says clients SHOULD NOT use this grant; prefer authorization code + PKCE. Kept so the contrast is visible.
Implicit Grant (Legacy)
RFC 6749 §4.2 returns an access token in the redirect fragment for a public client. No refresh token is issued. RFC 9700 §2.1.2 says clients SHOULD NOT use this grant; prefer authorization code + PKCE. Kept so the contrast is visible.
Sequence Diagram
Click any step for details
Request
Response
Redirect
Internal
Step-by-Step Breakdown
1
Authorization Request
Client → Authorization Server
2
User Authentication
User → Authorization Server
3
Fragment Token Response
Authorization Server → Client
Token Inspector
Specs for this flow
Sections of the protocol that normatively define this flow, plus the security considerations that apply to it.