The authorization code flow lets a client obtain an authorization code after a user authenticates and grants access, then exchange that code for an access token. It suits confidential clients such as web servers because the client can protect a secret. The browser carries out redirects, while the server performs the token exchange. section 7.4.1 section 7.8
A typical authorization code flow proceeds as follows:
- The application redirects the user to the authorization server with response_type=code, client_id, and redirect_uri. section 7.4.1
- The authorization server authenticates the user, requests consent, and redirects back with an authorization code. section 8.4.1
- The server exchanges the code, client ID, client secret, and matching redirect URI for an access token. section 8.4.1
- PKCE strengthens the exchange by requiring a code verifier, helping prevent access-token hijacking through CSRF attacks. section 7.8
FastAPI login with Auth0
A FastAPI server exposes GET /login and redirects the user to Auth0’s authorization endpoint. The request includes response_type=code, the client ID, a configured redirect URI, and an audience. After Auth0 returns the code, GET /token sends it to the token endpoint with the client ID and protected client secret, receiving the access token. section 8.4 section 8.4.1
https://auth.example.com/authorize?response_type=code &client_id=s6BhdRkqt3&redirect_uri=https://example.com
Use the authorization URL as a compact view of the initial request and its required parameters. section 7.4.1
