Skip to main content

OAuth 2.0 authorization code flow

The authorization code flow is a secure method in OAuth 2.0. It issues a temporary authorization code to a client application. The client uses this code to get tokens:

This flow suits confidential clients, such as web applications that securely store credentials. The user must approve access before the authorization server issues the code. Single-page apps must use Proof Key of Code Exchange (PKCE) to use this flow.

How authorization code flow works

This flow involves the user, client application, authorization server, and resource server.

Authorization_Code_Flow.svg

  1. User access. User opens the client application.

  2. Authorization request. Client application sends a request to the authorization server.

    Sample request to the /authorize endpoint:

    curl --location \
--get \
--url "https://$TENANT_ID.$REGION_ID.connect.secureauth.com/$TENANT_ID/$WORKSPACE_ID/oauth2/authorize" \
--data-urlencode "response_type=code" \
--data-urlencode "client_id=$CLIENT_ID"

  3. Consent display. Authorization server shows a consent form.

  4. User consent. User approves access.

  5. Authorization code issued. Server returns an authorization code to the client application.

  6. Token request. Client application sends the code to the server to get tokens.

    Sample request to the /token endpoint:

    curl --request POST \
--url "https://$TENANT_ID.$REGION_ID.connect.secureauth.com/$TENANT_ID/$WORKSPACE_ID/oauth/token" \
--data-raw "grant_type=authorization_code&code=$CODE&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET"

  7. Token validation. Authorization server checks the authorization code, client ID, and and client secret.

  8. Token issued. Authorization server returns the tokens.

  9. API call. Client application uses the token to call the resource server.

  10. Data returned. Resource server validates the token and sends the data.

Best practices

  • Redirection endpoints. Set up the redirect URL for the client application before making requests.

  • Scope management. Limit scopes when requesting tokens to reduce access risk.

In this section: