--- title: "Authorization Code Flow — Identity Glossary | IDSync" description: "The Authorization Code Flow is the OAuth 2.0 grant in which a client redirects the user to the authorization server, receives a one-time code at a…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Authorization Code Flow", "item": "https://idsync.com/glossary/authorization-code-flow" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/authorization-code-flow", "name": "Authorization Code Flow", "alternateName": [ "Auth Code Flow", "OAuth Authorization Code Grant" ], "description": "The Authorization Code Flow is the OAuth 2.0 grant in which a client redirects the user to the authorization server, receives a one-time code at a registered redirect_uri, and exchanges that code (with PKCE and/or a client secret) for tokens — the standard flow for almost every modern app.", "url": "https://idsync.com/glossary/authorization-code-flow", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Authorization Code Flow Standards # Authorization Code Flow The Authorization Code Flow is the OAuth 2.0 grant in which a client redirects the user to the authorization server, receives a one-time code at a registered redirect\_uri, and exchanges that code (with PKCE and/or a client secret) for tokens — the standard flow for almost every modern app. Last reviewed 3 months ago Key points - Two round trips: authorize redirect → callback with code → POST to /token → access token (+ ID token, refresh token). - Always pair with PKCE (mandatory for public clients, recommended for all). - Replaces the deprecated Implicit Flow for SPAs and mobile. - Use the state parameter (CSRF) and nonce (OIDC replay protection). - OAuth 2.1 and OIDC define this as the default and recommended grant type. ## What is the Authorization Code Flow? The **Authorization Code Flow** is the OAuth 2.0 grant type that virtually every web, mobile, and SPA app should use. It's a two-step dance designed so that powerful tokens never live in the browser URL bar or browser history. ## How it works (with PKCE) 1. **Client** generates a random `code_verifier` and computes `code_challenge = SHA256(code_verifier)`. 2. **Browser redirect** to `/authorize` with: `response_type=code`, `client_id`, `redirect_uri`, `scope`, `state` (CSRF), `nonce` (OIDC), `code_challenge`, `code_challenge_method=S256`. 3. **User authenticates** at the authorization server (passkey, password+MFA, SSO). 4. **Authorization server** redirects back to `redirect_uri` with `?code=&state=`. 5. **Client** verifies `state` matches, then POSTs to `/token`: `grant_type=authorization_code`, `code`, `redirect_uri`, `code_verifier`, and (for confidential clients) `client_id` + `client_secret`. 6. **Token endpoint** returns `access_token`, optionally `id_token` (OIDC), and optionally `refresh_token`. ## Why this dance - The code is **one-time, short-lived (≤60s typically), and useless without the verifier**. - The tokens are **delivered over a back-channel POST**, not in URL fragments — they never appear in browser history, referrer headers, or server logs. - The `state` parameter prevents CSRF on the callback. - The `nonce` parameter (OIDC) prevents ID-token replay. ## Common misconceptions - **"Implicit Flow is faster."** It's deprecated. Use Auth Code + PKCE. - **"Client secret protects everything."** Not for public clients (SPAs, mobile) — they can't keep one. That's exactly why PKCE exists. - **"`state` is optional."** Treat it as required. Skipping it opens you to CSRF on the callback. ## Editorial note If you're integrating OAuth from scratch, use a vetted library (oauth4webapi, MSAL, openid-client, AppAuth). The flow is simple in principle and full of footguns in practice. ## Standards & references - [RFC 6749 §4.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [authorization](/directory/category/authorization) ### Related terms [oauth 2](/glossary/oauth-2)[openid connect](/glossary/openid-connect)[pkce](/glossary/pkce) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the authorization category. [Explore tools](/directory/category/authorization) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.