Authorization code flow
The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
Spring in Action, Sixth Edition
An OAuth2 flow in which a client exchanges a short-lived authorization code for an access token after the resource owner grants consent.
- How it is used
- Enables a client to obtain a user-approved access token for calls to a protected REST API.
- How deep it goes
- Works through consent, redirects, code exchange, server and client configuration, and bearer requests; does not detail OAuth 2 specification internals.
- Examples
- Uses an ingredient-management client, registered-client and YAML configurations, a curl token exchange, and an authenticated ingredient request.
- What you can do after
- Apply it via Spring Authorization Server and Spring Security OAuth 2 client support to obtain tokens and call a protected API.
Read how Spring in Action, Sixth Edition explains authorization code flow →
Software Security for Developers
The authorization code flow is an OAuth flow in which a client obtains an authorization code through user authorization and exchanges it for an access token.
- How it is used
- Handles user-involved access to protected backend data through an identity provider.
- How deep it goes
- Explains actors, redirects, one-time codes, token exchange, and token validation, while deferring protocol internals.
- Examples
- Uses an ACME shopping-list scenario, localhost OIDC endpoints, browser redirects, YAML configuration, and cURL token requests.
- What you can do after
- Apply it via browser redirects and cURL to obtain an access token without placing that token in the redirect.
Read how Software Security for Developers explains authorization code flow →
Secure APIs
The authorization code flow is an OAuth authorization flow in which a client obtains an authorization code through user authorization and exchanges it for tokens.
- How it is used
- Delegates user-authorized API access through a web application’s server-side login and token exchange.
- How deep it goes
- Explains redirects, request parameters, consent, code exchange, secrets, PKCE, and a FastAPI implementation.
- Examples
- Uses a job portal accessing LinkedIn, Auth0 redirects, FastAPI routes, authorization URLs, and token-exchange requests.
- What you can do after
- Apply it via FastAPI and Auth0 by constructing a login redirect and exchanging the returned code for an access token.
Authorization in Action
The authorization code grant is an OAuth flow in which a client obtains a short-lived authorization code after user authorization and exchanges it for an access token.
- How it is used
- Enables people to delegate scoped API access to third-party applications without sharing passwords.
- How deep it goes
- Explains consent, code exchange, token validation, and subsequent Cedar policy evaluation rather than protocol internals.
- Examples
- Uses Kate connecting BI Explorer for workspace and document-metadata access with selectively approved scopes.
- What you can do after
- Apply it via OAuth to grant a client scoped delegated access, then enforce requests through gateway validation and Cedar.
Read how Authorization in Action explains authorization code flow →
Spring Security in Action, Second Edition
The authorization code grant type is an OAuth flow in which a client obtains a token through an authorization code, commonly after user authentication.
- How it is used
- Authenticates users while keeping login on a separate authorization server and authorizing client requests to a resource server.
- How deep it goes
- Traces redirects, code issuance, credentialed token exchange, and API authorization, while treating PKCE as supplementary protection.
- Examples
- Uses a web or mobile invoices application in which Mary signs in before viewing company invoices.
- What you can do after
- Apply it via a client that exchanges a returned authorization code for an access token and calls protected backend endpoints.
Read how Spring Security in Action, Second Edition explains authorization code flow →
Quarkus in Action
The authorization code flow is an OAuth-based authentication pattern in which a client redirects an unauthenticated user to an identity provider and exchanges a returned authorization code for tokens.
- How it is used
- Secures browser-facing web applications by redirecting unauthenticated users to an identity provider.
- How deep it goes
- Explains redirect behavior and Quarkus configuration but does not detail token exchange internals.
- Examples
- Demonstrates a protected /whoami page, Keycloak login with alice, and a /logout endpoint.
- What you can do after
- Operate a Quarkus web application secured through Keycloak redirects and configured session logout.
Read how Quarkus in Action explains authorization code flow →
ASP.NET Core in Action, 3e
An authorization code is a short-lived intermediary credential that a client exchanges, together with appropriate authentication, for an access token.
- How it is used
- Delegates access to a provider API while keeping the user’s provider credentials away from the client application.
- How deep it goes
- Explains the redirect, consent, callback, code exchange, and API call, but does not detail implementation code.
- Examples
- Uses dogphotos.com retrieving a user’s Facebook photos after consent and token exchange.
- What you can do after
- Understand how to delegate API access through a provider without giving the application provider credentials.
Read how ASP.NET Core in Action, 3e explains authorization code flow →
Building Distributed Applications that Work
The authorization code flow is an OAuth-based protocol in which a client exchanges an authorization code for tokens through a server-side interaction.
- How it is used
- Uses a server-side code exchange to obtain tokens for an application authenticating through an identity provider.
- How deep it goes
- Defines the code response and server-side token exchange, then describes configuration options without detailing exchange execution.
- Examples
- Configures an ASP.NET Core UI app with a code response, saved tokens, and optional PKCE.
- What you can do after
- Configure ASP.NET Core OpenID Connect to request code responses, save tokens, and handle provider callbacks.
Read how Building Distributed Applications that Work explains authorization code flow →
Related concepts
- API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- client credentials grant typecontrasts with · The client credentials grant is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user involvement.
- grant typekind of · A grant type is an OAuth-defined authorization flow or token-request parameter specifying how a client obtains an access token.
- authorization codeuses · An authorization code is a short-lived credential issued by an authorization server for a client to exchange for an access token.
- Proof Key for Code Exchangeused by · Proof Key for Code Exchange (PKCE) is an OAuth security extension in which a client proves possession of a per-request secret when exchanging an authorization code.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.