thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Authorization Code Flow

OAuth grant where the client receives a short-lived code via the browser and exchanges it server-side for tokens.

Definition

The authorization code flow keeps tokens out of the browser's address bar and history, and confidential clients authenticate when redeeming the code. Combined with PKCE, it is the recommended flow for web, mobile, and single-page applications. Other grants include client credentials for machine-to-machine use and device code for input-constrained devices.

Example

A web app redirects to the IdP, receives ?code=abc123 at its callback, then posts the code to the token endpoint.

Exam tip

Use authorization code + PKCE for user sign-in; client credentials for service-to-service.

Related terms