The authorization code flow lets a client access a user's backend data without receiving the user's credentials. The user authenticates at an identity provider (IdP), which returns a one-time authorization code; the client exchanges that code for an access token and presents the token to the resource server. Sending the token directly through the redirect would expose it to browser history or logs. section 12.2.1 section 12.4
The flow coordinates four actors:
- The user requests protected data from the client application. section 12.2.1
- The client redirects the user to the IdP, where the user logs in. section 12.2.1
- The IdP redirects back with a unique, one-time authorization code. section 12.2.1
- The client sends the code to the IdP's token endpoint, receives an access token, and uses it to call the resource server. section 12.2.1
ACME shopping list
For ACME, the client discovers the IdP's authorization and token endpoints, redirects the browser to /oauth2/authorize?response_type=code, receives a callback containing code=..., and uses cURL at /oauth2/token with grant_type=authorization_code to obtain an access token. The client then presents that token when requesting the shopping list. section 12.3
