The authorization code flow authenticates a user through a separate authorization server before the client receives an access token for its backend requests. It is the most commonly used grant type for user authentication. section 13.3 section 13.3.1
The flow proceeds in a browser and then through a token request:
- Redirect the user from the client to the authorization server's login page. section 13.3.1
- After successful authentication, redirect the browser back with a unique authorization code. section 13.3.1
- Exchange the code for an access token; the client verifies its identity with credentials during this request. section 13.3.1
- Use the access token when requesting authorized data from the resource server. section 13.3.1
Invoice application
Mary opens an invoices web or mobile application without being logged in. The application redirects her to central authentication; after login, it receives a code, exchanges it for a token, and requests her invoices. section 13.3.1
Figure 13.9 The authorization code grant type. The user is required to sign in. After login, the authorization server issues an authorization code to the client, which the client then utilizes to obtain an access token. This access token enables the client to have its requests authorized by the resource server.
Follow the sequence diagram to distinguish browser redirects from token requests and resource-server calls. section 13.3.1
